How may I assign static listen addresses to the admin webpage ?

RE: How may I assign static listen addresses to the admin webpage ?

J Thai — Fri, 18 Feb 2022 14:18:07 GMT

I see. So is this the correct procedure to manage my Sophos XG firewall system ?

Name a Host IP (Group) >> Set (VLAN) Interfaces >> Group the interfaces into (LAN) Zones >> Adjusting ACL matrix >> Modify (Application) Filter >> Create Firewall Rules or Policies.

RE: How may I assign static listen addresses to the admin webpage ?

LuCar Toni — Thu, 17 Feb 2022 07:59:38 GMT

You can do both.

Basically the firewall is a ip based firewall. You do not have to do it but you can do it.

If you start to use individual zones, you can start to do "VOIP to Printer", voip and printer are own zones.

Then you need more firewall rules.

RE: How may I assign static listen addresses to the admin webpage ?

J Thai — Thu, 17 Feb 2022 07:07:04 GMT

I just happened to come across this Youtuber who is posting tutorial video clips about Sophos XG v18. This guy has a habit of going to the 'Hosts and Services' tab and create IP hosts (host groups) before creating an interface.

youtu.be/wI6RPNNuHS4

Here, 2 more questions have arisen from me :

Does this habit have any benefits for me when using Sophos XG v18 ?
Does this habit increase the granularity when I issue firewall & ACL policies & rules as well ?

Thank you again buddy.

RE: How may I assign static listen addresses to the admin webpage ?

J Thai — Wed, 16 Feb 2022 14:02:32 GMT

Then what can I do now to achieve the question in the title of this topic ? And what else can I do later on to re-gain your ‘granulate’ !?

RE: How may I assign static listen addresses to the admin webpage ?

LuCar Toni — Wed, 16 Feb 2022 08:46:09 GMT

You can use one Zone, but you will lack in granulate later. With Zone based concepts and VLANs in own Zones, you can define more granular firewall rules in a quicker manner.

RE: How may I assign static listen addresses to the admin webpage ?

J Thai — Wed, 16 Feb 2022 02:57:43 GMT

Well, I have created multiple VLAN interfaces and mostly all of them have been put under the LAN zones. Has this been un-wise for me to do so ? If so, how can I now limit it without having to rely on Zones ?

RE: How may I assign static listen addresses to the admin webpage ?

LuCar Toni — Tue, 15 Feb 2022 09:05:10 GMT

HTTPS is Webadmin.

But based on your screenshot, you are using the same Zone for every Interface. So you cannot limit it based on Zones.

RE: How may I assign static listen addresses to the admin webpage ?

J Thai — Tue, 15 Feb 2022 02:22:52 GMT

Thank you for your reply. I can not yet find the option for only trusted zones within "Local service ACL / HTTP". This is my interface. Where may I find it ?

RE: How may I assign static listen addresses to the admin webpage ?

dirkkotte — Sat, 12 Feb 2022 08:32:46 GMT

Within administration / device access select only trusted zones within "Local service ACL / HTTP"

... or more restrictive ... select only trusted hosts within "Local service ACL exception rule" and allow HTTP access.

but be careful ... first allow / test / forbid ... do not forbid your own access.

RE: How may I assign static listen addresses to the admin webpage ?

J Thai — Sat, 12 Feb 2022 02:06:30 GMT

Thanks for your reply. How can I do it ?

RE: How may I assign static listen addresses to the admin webpage ?

dirkkotte — Fri, 11 Feb 2022 19:36:20 GMT

You should only allow webadmin access from dedicated hosts.

Not the target IP but the source IP should be decisive.

RE: How may I assign static listen addresses to the admin webpage ?

LuCar Toni — Fri, 11 Feb 2022 12:23:47 GMT

Did you block the Webadmin via Device Access?