Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Sophos Factory offers a free Community Edition. Sophos Factory Sophos Factory Community Edition
Sophos Factory supports self-hosted runner. Runner Pools orchestrate Runners, machines or containers, which are used to execute pipelines.
You can host them on different platforms: https://docs.factory.sophos.com/docs/runners/self-hosted-runners/
They will generate and execute your code - To allow runners to execute code on your Sophos Firewall, you have to do two things on SFOS:
Allow SSH Access in case you want to execute SSH commands on SFOS.
Allow API Access in case you want to execute an API Command on SFOS.
The first step is to run a simple "What is my IP command". You can use this code as an XML:
---
variables: []
steps:
- id: getIP
name: Get Runner IP
type: http
depends: []
properties:
url: 'https://httpbin.org/ip'
method: GET
validate_certs: true
timeout: 30
headers:
- key: Content-Type
value: application/json
status_codes:
- 200
outputs:
- key: ipAddress
value: '{|steps.getIP.result.body.origin|}'
layout:
elements:
- id: getIP
position:
x: -122
'y': -145
links: []
image_id: f5b6fd0d-0a2c-4b09-869a-92644ff7314c
It will reflect the current WAN IP of the runner. This step is just to double check the WAN IP of the runner.
The next step is to create the credentials of your Sophos Firewall in Sophos Factory.
You can choose from different kind of credentials. Most likely you will use admin + password of SFOS.
See: https://docs.factory.sophos.com/docs/reference/credential-types/ 
On SFOS:
Go to Administration - Device Access and allow HTTPS (and SSH) for Factory. Create a new Local Service ACL Exception rule and add HTTPS + SSH for your Factory WAN IP.
Note: Add only SSH, if you want to execute SSH commands. HTTPS is needed for API Calls.
Under Backup & Firmware - API enable API Configuration and add the API of Factory as well.
Now you can test your setup by executing a Sophos Firewall pipeline. For example go to the solution catalog, search for SFOS and take the API request Pipeline.
Add your parameters and run the pipeline.
You should see as Request result all IP Hosts and an "Authentication Successful".
Edited TAGs and Title
[edited by: emmosophos at 11:10 PM (GMT -7) on 1 Apr 2024]
