Are there plans to include an "anti-portscan" feature in sophos XG?

Question

The UTM has an essential feature called "anti-portscan" that is seperate from DoS protection.Anti-portscan, if you are not aware, will detect when a source IP address is scanning the external WAN interface for open ports, and block, drop, or log the source IP. 
 While not necessary for functionality, since Sophos firewall will block all connection attempts anyways, portscan detection/prevention can at least provide an email alert to an admin that a device is scanning the external interface for open ports. 
 From what I gather, DoS is not necessarily the same, but is still erroneously considered "port scan prevention" but is not, since it is nothing more than TCP/UDP flood protection, to prevent infected hosts in the LAN from running denial of service attacks on clients/servers on the internet. 
 So the advantages of portscan detection and prevention are: 
 Sophos detects that ports are being scanned from the same IP address and the IPS can send an email to an admin. 
 The IPS automatically blocks, drops, or logs the IP so that the attacker cannot see open ports (or be DNAT'd to a device listening for connections) if there are any.

LuCar Toni · Answer

I had this discussion plenty of times and my point of view: Anti-Port Scan is not viable and does not provide any extra layer of protection in any sharper form. 
 Simply because literally no attack will work like this. Shodan and other tools are there to do this job and they are build to workaround such Anti-Port Scans by building and using a a Distributed network. 
 You can read about my take here: Port scan Detection XG18 
 While you can also talk about the XDR Point of view (Hey show me more infos about this IP or who scanned my network etc.) - What will you do about this information. 
 And i am not aware of any attacker, using his attack client to also do the evaluation phase. 
 Shodan and other tools are 24/7 scanning the internet, so if this tool would work, you should not find your firewall in the internet with all information. But likely you will. So the anti-port scan feature is likely not working as it should (because it cant).

Vishal_R · Answer

Hi alan weir Thank you for reaching out to the Sophos community team. There is an existing feature request on it (SFSW-I-776). I would suggest getting in touch with your partner or regional sales team to get more details. How can a customer or partner submit a feature request? Existing customers should contact their Sophos partner or sales representative directly.

Are there plans to include an "anti-portscan" feature in sophos XG?

Top Replies