XG Firewall HeartBeat with existing Anti-Virus

Question

Hi, 
 I will start using Firewall XG for the first time and from what I read on the documentation it has a heartbeat feature that requires to install a local agent in each cmpyter on the network, to ensure max protection, correct? 
 At the moment all my office computers already run Kaspersky Anti-Virus, and I would like to keep it in order to have double protection (Sophos XG Firewall + Kaspersky), but I don't know if will it cause problems / compatibility issues. 
 So my question is if can I install the Sophos Firewall XG agent with Kaspersky, having both running at the same time, OR in order to install the XG Firewall agent I need to remove/unistall the Kaspersky? 
 Thanks!

David Birdsall · Accepted Answer

Mike, 
 Thanks for asking. I my initial response was vague. Im happy to explain in more detail: 
 First of all, the Sophos XG Firewall is a physical appliance. It normally sits at the "head" of your network. It can be the "active" gateway of your network, or it can be a "passive" device between your gateway and the ISP modem, between your gateway and the router, or between the Router/Gateway and the rest of your network. You can buy an XG Firewall assembled by Sophos. You download the Sophos XG Firewall software and install it into your own firewall appliance or PC (not a PC for a desktop). You can deploy the XG firewall software or readily available virtual images in VMWare, Citrix, Hyper-V, Oracle, and other virtualization platforms such as in Amazon, Google, and Rackspace. I assembled my own firewall at home, but I ordered two from Sophos for my office. I have also deployed virtual firewalls for clients. Regardless of which XG product you deploy, they all work the same. If you have multiple gateways/ISPs you can deploy an XG firewall on each of them and run the XG Firewalls in "active" parallel high-availability to share bandwidth and provide automatic failover. 
 Mike G said: For example, I have Bitdefender which has a software "firewall". What I'm concerned about is whether the Sophos XG scanning clashes with the OS AV I have on my endpoint. Essentially what I'd like to know is if there would be any conflicts between a users personal choice of endpoint AV, and using the XG firewall WITHOUT heartbeat, and probably not requiring it. 
 Second, the XG Firewall doesn't install on end points, nor does it access them. There is no XG Firewall agent. This means the XG Firewall doesn't scan endpoints or any other device on your network. The XG Firewall is a true firewall in that it merely scans the packets traveling through the firewall on the zones/interfaces/ports/vlans/services you choose. Any Antivirus/AntiMalware you have on your endpoints, including software firewalls, will run separately. This means your existing Kaspersky and BitDefender end point software is separate and unaffected by your Sophos XG Firewall (unless you use the XG Firewall to block a service/port required by Kaspersky or Bitdefender). I have Sophos Home on my personal Mac and the Macs of my relatives which run separately from the Sophos XG Firewalls at their locations and mine. 
 Mike G said: I'm curious what you mean about 2 firewall scanning systems. 
 I originally thought nqserve was deploying two firewall appliances. That is not the case, but there is still a dual scan option that you should know about. The XG Firewall comes with two scanning engines. The default scan in the XG Firewall is conducted by the Sophos Scanning Engine. Sophos also includes another option. You can choose to use the Avira engine instead . You can also choose to activate both in dual scanning. This setting applies across the entire firewall regardless of other settings. You can build more complex controls depending on the websites, services, VPNs, Intrusion Prevention, and Advanced Threats you wish to manage. You can also integrate other Sophos products to work with your XG Firewall and extend coordinated security across the network. 
 Mike G said: Also can a home user buy a single license of Intercept X? It looks quite interesting. 
 Sophos specializes in Enterprise security. Every XG Firewall is enterprise level security; including the "Home" evaluation version. The XG Firewall is adaptable to be used in any environment from Enterprise down to SOHO. The device in which you deploy the XG Firewall determines capabilities and limitations. Better appliances with more powerful CPUs and more ports allows more complex security options to be built. For home use, a small Firewall Appliance or an old PC with multiple network ports will suffice. 
 By default the XG Firewall scans outgoing data/requests and matches them to incoming responses. Synchronized Services is not activated by default as it requires requires Sophos Central . With the exception of Sophos Secure Wi-fi Access Points, coordinating the XG Firewall with Synchronized Services requires Sophos Central . You also need to install Sophos End Point Protection on your End Points. You can get Sophos End Point Protection separately, but if you purchase Intercept X, it comes with End Point Protection. The smallest license pack in which you can get End Point Protection is 25 devices, but it is still very affordable for many home users with less than 25 devices. If you deploy the End Point Protection or any other Sophos product on your End Point, it will ask you to remove your Kasperky, BitDefender, and other AV/AM products. 
 
 I hope this answers your questions . Since you are asking about some of the Synchronized Security, I wish to shed more light on the advanced ideas you wanted to test: 
 I like that no matter how complex I arrange Sophos security, the products continue to have little to no impact on system resources. I love the synchronized security of Sophos XG Firewall with Intercept X and End Point Protection. If an end point detects malware in itself or communicating from an a IOT device such as a printer, the End Point will alert the Firewall and other End Points. If the firewall detects an infiltration, attack, or some other issue, the XG Firewall will alert your end points. If you have Intercept X, it gets even better. Intercept X will give you the explanation of where the malware originated, where it went, what it did, and most importantly, what it reported or sent out of your network. Did it come from an encrypted printer update through the firewall? Did it come from a smartphone or wireless device talking to the network through Wi-Fi? Did it come from a thumb drive in a USB port? What did it do? Are my files now encrypted in ransomware? Did all my financial data and username/passwords get sent out to some hacker? Did a bunch of invisible backdoors get installed on my devices and firewalls? Intercept X will show you. Not only will you be alerted to the issue and shown what happened, Sophos Synchronized Services can manage all your Sophos products to automatically manage the situation. Chances are that the issue didn't affect you at all as the Sophos Central suite can automatically react to stop, clean, and reestablish proper security when it senses an issue. For example, if Active X detects active ransomware, Sophos Central will direct End Point Protection to stop the ransomware, decrypt anything that was encrypted, replace any locked files with clean backups from just before the attack. End Point Protection, Intercept X, and XG Firewall with Secure Wifi APs will work together to identify any data that was exfiltrated out of your network and secure all ports better. If you don't have the default automatic coordinated response turned on, you can control scanning, cleanup, and settings remotely without needing to go to every device - even when you're away from home. 
 If you have Sophos Secure Wi-Fi , Sophos Mobile Device Management, and Sophos Encryption deployed, it gets even easier to manage more concerns and solve the few remaining issues that pop up. If you're only dealing with Home level needs, you probably don't need Sophos Encryption as is merely serves the need of Data Loss Prevention, and DLP is complex to deploy. If you don't have any kids, you probably don't need Sophos MDM either. You can use the free the Apple Configurator 2 for Apple Devices. Free MDMs may be available for Windows, Chrome, and Android devices. If you're looking to upgrade or extend your Wi-Fi, I highly recommend Sophos Secure Wi-Fi APs as they integrate directly with your XG Firewall without the need for Sophos Central. You're Sophos XG Firewall will serve as the Secure Wi-Fi controller. Since the most dangerous issues with network security have to do with guest devices and your own devices leaving the network for long periods of time and reentering the network through WiFi, Secure Wifi gives you extra layers of protection and response automatically coordinated with your XG Firewall. This prevents malware from bypassing your firewall and entering your network behind your firewall. 
 Since most people have never heard about or used Sophos, many people will immediately balk and recommend other products. The truth is that Sophos is the OEM for most products that people will recommend to you. Norton's BlueCoat is Sophos. Cisco, Juniper, and IBM security are all Sophos. FireEye products are made from Sophos. The security at Rackspace is Sophos. TrustWave Products and Services as well as Ivanti's Heat Software are Sophos. There are very few big names in security that don't use a Sophos OEM. Many people stare at me in utter disbelief when I tell them this, especially if they know that Sophos is from the UK. They are still hesitant to try the products as it's simplicity and speed seems like a home level product compared to the clunkiness to which they are accustomed. But once they try it, they are usually impressed, even if they have a few remaining reservation. I love installing Sophos Central and it's related products for clients. It never gets old hearing them tell me how their problems have been eliminated with an automated system they feel they can deploy without affecting user's devices and easily control however they wish. 
 That leads me to: Why are you using multiple brands of products? The days of not using the same company for everything due to fears of the same hole being replicated from product to product are long gone for Sophos. Sophos developed it's scanning engine and several of it's OEM products for End Points. Along the way, Sophos smartly acquired other great technologies, like Astaro firewall (UTM and XG Firewalls) and SurfRight CryptoGuard (Intercept X), and developed them from great products that filled the gaps into into more amazing products that integrate and coordinate effectively. I am not saying you can't use Kasperky or BitDefender with your XG Firewall. It's your network - I encourage you to experiment and figure out what works best for your needs. If you do want to purchase End Point Protection to coordinate with your XG Firewall, then you you will be asked to remove Kaspersky, BitDefender, and other antimalware. If you leave Kasperky or BitDefnder in place, you may have problems diagnosing issues when things don't communicate. Is the issue in Kasperky? IS it in BitDEfender? Is it in Sophos? Is it in all? You will also suffer from slowdown do to loss os system resources. 
 That's It. 
 David

Ashen1 · Answer

Hi, 
 
 If you are pertaining to 'Security Heartbeat' , You need to have at least an XG firewall (running SFOS of course) and either of Intercept X/ or Central Endpoint Advance in order to make it work. 
 
 If you intend to keep your Kaspersky, then I would recommend you not to install CEA, just Intercept X as it would work alongside any AV. 
 
 Regards, 
 Raphael

David Birdsall · Answer

nqserv, 
 It depends on where you are doubling up on your protection. In other words we really need to know what Kaspersky products you have deployed or wish to use. 
 If you are talking about having dual End Point protection on your computers, most End Point protection systems don't allow other End Point protection systems to run on the same End Point. You can only install one active vendor, but you can have as many different passive cleaners you want - like Sophos Clean. 
 If you are talking about running two Firewall scanning systems, this can cause problems. To solve this, Sophos includes two Anti-Malware Scan engines in the Sophos XG Firewall: Sophos and Avira. By default, your XG Firewall uses the Sophos scanning engine, but you can set your XG Firewall to use Avira or Dual Scan (both). 
 If you want to integrate your XG Firewall with your End Points, you can purchase Intercept X or Sophos EndPoint which integrates with the Sophos XG Firewall through Sophos Central and Security Heartbeat. *In order to use Security Heartbeat with XG Firewall, you must set the scan engine to the default Sophos engine or Dual Engine protection.* If you have 10 computers or less, you can use Sophos Home on your computers for free, but Sophos Home does't integrate with XG Firewall, Sophos Central, or Security Heartbeat. 
 So yes, you can use Sophos XG Firewall alongside Kaspersky depending on what Kaspersky products you have deployed. Intercept X is also designed to be used alongside other AV products like Kaspersky.