Sophos Central Firewall Manager - CFM 17.1.0 GA Released

Hi XG Community!

We've finished CFM v17.1.0 GA. 

What's New

Key Features

  • Shadow IT management across firewalls
  • Improved alerting contents
  • Comprehensive management of all features available in Sophos XG Firewall v17.1


  • Added additional Settings to Authentication Servers -> RADIUS Server
  • Shadow IT discovery support
  • Configurable SSL VPN port
  • Allow user to edit rule while double clicking on the rule
  • Easily control Google QUIC during firewall rule creation
  • Added Email Exceptions
  • Allow creation of empty smart filter
  • Allow and Block lists for Email/Domains on Admin Portal


Here's a overview of the compatibility of CFM to different Sophos Firewall versions: 6710.Compatibility Guide for CFM and SFOS.pdf

Known Limitations

  • Admin can not change password of SF 17.5 device from SFM/CFM device level.

  • In CFM, device info service is not responding. Therefore UI is taking some minutes to load which lead to feel CFM is not responding.

Issues Resolved

  • NCCC-6339 [SCFM] CFM does not fetch SF firmware detail through feature 'check for latest firmware' due to opcode timeout
  • NCCC-6369 [SCFM] Connection status show disconnected though HB packets are reaching to CFM/SFM
  • NCCC-6398 [SCFM] Unable to import all configuration as template from SG device
  • NCCC-6422 [SCFM] Scheduled backup is not taken in SCFM
  • NCCC-6671 [SCFM] XG devices losing sync to CFM frequently
  • NCCC-6697 [SCFM] Schedule backup is taken on next day in SCFM
  • NCCC-6430 [SFM] Unable to push the application based traffic shaping policy to the firewall from SFM using template
  • NCCC-6731 [SFM] Unable to modify Admin user
  • NCCC-6737 [SFM] Firewall rules showing up "0" in template when importing configuration into template in SFM
  • NCCC-6750 [SFM] Cannot delete host: Selected Entity(ies) cannot be deleted due to dependency. Check Entity Usage Reference for dependency details.
  • NCCC-6765 [SFM] Template with more than one remote networks does not work
  • NCCC-3198 [SFM-SCFM] Unbound or disabled physical port on XG firewall should not shows up as "interface status" DOWN in SFM/CFM
  • NCCC-6443 [SFM-SCFM] Unable to restore backup from SCFM
  • NCCC-6666 [SFM-SCFM] SCFM unresponsive at times. Extremely slow most of the time
  • NCCC-6667 [SFM-SCFM] Cannot add generic top-level domains to the Web's URL groups
  • Where can we get this? I don't see it in MySophos or in the firmware check within the SCFM.

  • It is already installed on the CFM. SFM will come later.

  • Why now publishing SFM earlier than CFM? In past this was handeled different. That was a reason why we recommended our customers to use SFM instead of CFM. Why that change now? Please publish it at least at the same time.

  • The same applies to us. We migrated all our customers to the SFM because it took CFM longer to be supplied with updates. What is the strategy on behalf of Sophos? Will the CFM be supplied with updates earlier in the future?

  • When comes the update for SFM?

    If the SFM is released we can upgrade our XG to 17.5

    If we upgrade XG to 17.5 we can use the Sophos Central Dashboard to manage our Firewalls.

    If we can use Sophos Central Dashboard to manage our Firewalls we do not need SFM?