In Sophos Firewall version 17.5, existing IPS categories will be replaced with a new set of IPS categories. A new set of IPS categories will provide customers additional granularity of both categorization and distribution of IPS signatures as well as will bring IPS categorization in-line with industry standards. From 29th November 2018, a new set of IPS signature packs will be available (High End and Regular). Sophos will be releasing a brand new set of IPS Categories replacing existing set of IPS categories. The following sections are covered:
Applies to the following Sophos products and versions Sophos XG Firewall version 17.5
Customers with the following platform types/versions will receive the new set of IPS categories:
Two IPS Signature Packs are available dependent on the size of hardware:
Firmware version for which the new set of IPS categories will be released:
Customers running any SFOS firmware revisions v16, v17 or v17.1 and have chosen not to upgrade their products to v17.5, they will continue to receive Signature Packs with an existing set of IPS categories.
Customers Upgrading to SFOS Firmware version v17.5:
Customer experience when a Signature Pack with a new set of IPS categories will be downloaded and installed successfully.
Below are the changes that customers are likely to observe once a Signature Pack with a new set of IPS categories is downloaded and installed successfully on their systems:
Before download, there are 21 IPS categories visible within the Management User Interface and IPS signatures are seen distributed/categorized amongst the 21 IPS categories. After the download and installation of the Signature Pack containing the new set of IPS categories, there will be a total of 60 categories and the IPS signatures will be evenly distributed/categorized among those new categories.
There will be minimal changes (if any) seen/observed within the existing FW/IPS policy in terms of number of signatures deployed/enforced on the system post IPS category migration. However, a user or administrator may see/observe the new set of mapped IPS categories within the FW/IPS policies.
If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article. This is invaluable to us to ensure that we continually strive to give our customers the best information possible.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. For technical support post a question to the community. Or click here for new feature/product improvements. Alternatively for paid/licensed products open a support ticket.