How to monitor MAC firewalls from Sophos Central

Question

Hi 
 I want to manage ( monitor & enforce ) MAC OS native firewalls on the MAC machines that are being managed by Sophos Endpoint Protection and Sophos Mobile. 
 How can I do this ? I want to at-least monitor whether the native MAC firewall is turned on 
 Thanks for the kind help in this regards in advance. 
 rehan

Yashraj S · Answer

Hi rehan tahir 
 Yes, it is possible to configure the inbuilt application firewall of your Mac device from Sophos Mobile. You will need to go to Profiles and Policies > macOS > Device Policy > Add Configuration > Firewall. For more clarity on the settings available for configuring the firewall settings, please visit the following link: https://docs.sophos.com/central/Mobile/help/en-us/esg/Sophos-Mobile/references/ConfigurationFirewallMacOSD.html

Yashraj S · Answer

Hi rehan tahir 
 I tried to reproduce the issue with my account and Mac device. In my test policy for my Mac device (I named it "Test Mac OS Device Policy"), I have disabled the firewall and allowed Sophos Kernel extensions. Checking the device properties on Sophos Central, I can see that the firewall has been disabled. 
 
 I went on to the device and noticed that even after unlocking the settings for the firewall, I cannot enable it natively and is grayed out. The policy which I received shows that the firewall option is set to disable. This means that once the policy is received on the device and is implemented, settings cannot be changed by the user natively.

Now, when you manually enabled the firewall on your device before Sophos Mobile could do it for you, it might have left it in a broken state. Sophos Mobile tried to enable it for you but it was already enabled and hence the command could not be successfully executed on the device. This might be a reason why it still shows the outdated information in device properties.