Related
Recommended
AlanT
Central Firewall SSO Showdown - New vs Original.mp4

Hi Sophos Community,

I'm excited to announce a major update to the firewall single-sign-on service available today in Sophos Central. This service allows you to access the local user interface of a firewall that is managed by Central, without needing to expose the UI of that firewall over the internet. This has been a staple of firewall management in Central for a long time, and I'm excited to announce a major update to this service, available now in Sophos Central, for all managed firewalls running SFOS v21 and newer.

Features

  • Faster connections- initial connectivity from Central will bring you to a responsive webadmin in a fraction of the time!
  • Faster navigation - once logged in, navigating through the firewall UI is faster than ever, and should now be comparable to being directly logging into the firewall.
  • Tabbed sessions - Firewall management sessions will open in a new tab, allowing you to easily reference other info in your Central account while also managing your firewall
  • Multiple firewall sessions - Connect to multiple firewalls at the same time, from the same Central login! Each session opens in a new tab, allowing you to easily compare settings between firewalls
  • Legacy support - Firewalls running SFOS v21.0 and newer can be managed from Central with all of the above benefits, while firewalls running older versions will continue to work like they always have. Firewalls supporting the new SSO service will have an icon next to the name in your firewall inventory list, indicating it will open in a new tab when clicked.
  • Reduced outbound port requirements - v21 firewalls using the new SSO service, and subject to upstream port restrictions now only require outbound access to Sophos Central on port 443 to be fully managed in Sophos Central. 

Requirements

  • One or more firewalls managed in your Central account
  • One or more of your managed firewalls upgraded to v21 GA or newer
  • in reply to AlanT

    "If you've observed inconsistent speeds from day to day when connecting to a firewall" yes, I did. Thanks for your reply and explanations! The whole v21 UI feels way more responsive and so does this feature.

  • Very good improvement! - Works fine on first few appliances tested - thanks!

  • in reply to LHerzog

    the new service is a complete rewrite based on newer web technologies. the older sso relies on the firewall polling for connection requests, where the new one uses a persistent, long-lived session that can respond almost instantly to requests. repeat connections are faster for a while in the old sso because the connection to the firewall is maintained for a while after you finish with it, so polling isn't necessary if the connection is still present. Now though, all sessions should start faster, more consistently. 

    The new connection method is also more efficient as the service scales. If you've observed inconsistent speeds from day to day when connecting to a firewall, you should no longer see such slowdowns on the new service. Overall, it improves performance and reliability in every part of the process, and you shouldn't expect any higher resource usage as a result. 

  • I'm very happy to see the "Multiple Firewall Sessions" feature. Only being able to open up one firewall at a time in Sophos Central was a HUGE limiting factor. Thanks for making this big quality-of-life improvement!

    One thing: can Partners have the ability to launch multiple customers at the same time? So we can be in two firewalls from two different customers at once. This would help in situations where we do a settings migration. Currently we have to use a different browser or an Incognito/Private window to do this.

  • in reply to LHerzog

    Essentially we worked on the service doing the connection.

    The video above is not the general "expected performance" instead a measurement for the "worst case" (very slow appliance - virtual with one core etc). 

    The "challenge" with reverseproxy is, if you want to open a webadmin, central can only cache your "request", and the appliance will pull this request. We speed up this process, plus other enhancements

Unfiltered HTML