Sophos MDR - Firewall Pre-Requisites

Hi Gabriel,

Thanks for reaching out to the Sophos Community Forum.

I can confirm that the minimum version required is SFOS v19. This is mentioned in the KBA that you linked as well: 

Prerequisites

• Sophos Firewall firmware version:
  • SFOS 19.0

I suggest checking Retirement calendar for Sophos SG UTM, Sophos Firewall.. as well, to ensure you're running a current/supported MR.

Hi Kushal,

So, you're saying that even if my firewall IS running 19.0 the MDR Threat Feeds will be sent and the network activity will be monitored by the MDR team? I know I might be sound skeptical, but I need to make sure, because we have a client that just signed the MDR service and have some Sophos APs that are currently being managed by the Firewall and cannot be sent to the Central due to hardware incompatibility.

Is there anyway I can check if the integration is working as intended?

Hi Kushal,

So, you're saying that even if my firewall IS running 19.0 the MDR Threat Feeds will be sent and the network activity will be monitored by the MDR team? I know I might be sound skeptical, but I need to make sure, because we have a client that just signed the MDR service and have some Sophos APs that are currently being managed by the Firewall and cannot be sent to the Central due to hardware incompatibility.

Is there anyway I can check if the integration is working as intended?

There are two different things to take care of: 

Integration 1: Firewall reports data to the data lake about block events and IPS events etc. This is included in V19.0 

Integration 2: MDR Team can push events to the firewall and block certain IoCs, This is included in V20.0 GA.

Ok, so you're saying that the monitoring is already working, but in the event of something they won't be able to interact with the firewall?

Yes. You need V20.0 GA for that. It is a feature called Active Threat Feeds:  Sophos Firewall v20 is Now Available