Sophos Firewall v21: VPN and Routing Enhancements

Products•Early Access Program•SFOS v21•Sophos Firewall

How to make the most of the new features in Sophos Firewall v21

Sep 23 2024 By

Sophos Firewall v21 brings exciting new enhancements to VPN, authentication, and routing functionality.

VPN Enhancements:

  • Bulk activate and deactivate options are now available for connections (see screen shot below).
  • Enhanced filtering on the VPN manage page now consolidates information across multiple pages
  • Free text and value-based search is now supported in VPN configurations for network, subnet, users for remote access and site-to-site VPNs.
  • An XFRM interfaces-specific view has been added on the Interfaces page for easy filtering of RBVPN interfaces

Site to Site VPN Enhancements:

  • FQDN-based remote gateways have been optimized to improve scalability for distributed deployments
  • DHCP relays over XFRM interfaces are now supported for traffic to DHCP servers deployed behind a remote firewall (see illustration below)
  • RBVPN deployment get an increase of up to 20x in XFRM interface up-time significantly minimizes disruption during tunnel flap, HA failovers, or reboots.

Authentication Enhancements:

  • Google Workspace integration via LDAP clients and Google Chromebook SSO compatibility with LDAP server types enables SSO functionality for Google LDAP for Chromebook environements
  • Performance for burst login handling is improved up to 4x for Radius SSO, STAS, and Synchronized User ID enabling the handling of thousands of simultaneous login requests even in multiple SSO environments (mix of STAS, Radius SSO, and Synchronized User ID).
  • In addition, support has been added for a transparent AD SSO experience when HSTS is enforced, enabling Kerberos and NTLM handshakes over HTTP or HTTPS.

Static and Dynamic Route Management

  • Users can clone static routes, turn them on or off, and add descriptions via the new Manage option for each static route in the table (see screen shot below).
  • There’s now a blackhole route option and support for Equal-Cost Multi-Path (ECMP) for load balancing.
  • Dynamic Routing gets a new option to redistribute BGP routes into OSPFv3.
  • Dynamic routing now experiences zero-impact during HA failover scenarios

 

Watch this short demo video to see how it works and how to set it up:

>

 

Start taking advantage of this great new capability in Sophos Firewall v21 by participating in the Early Access Program.  Simply register for the program, click the link in your email to download the firmware update package, and install it on your Sophos Firewall.

About the Author

Chris McCormack is a network security specialist at Sophos where he has been focused on firewall and network protection since joining Sophos in 2008. When not evangelizing Sophos network security products, Chris specializes in providing advice and insight into the latest threats and network protection technologies and strategies.