Thread Info
  • Replies 122 replies
  • Subscribers 61 subscribers
  • Views 126261 views
  • Users 0 members are here
Options
Suggested

Sophos Firewall: [LetsEncrypt] How To in Sophos Firewall

LuCar Toni

Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.

Note: Make sure your Sophos Firewall time is correct to avoid potential Certificate Trust issues

Overview

This Recommended Read reviews different options for obtaining a Let's Encrypt certificate.

UTM has LE Support for WAF (since UTM9.6). But on Sophos, you can use LE certificates as well. Seems like many people does not know, you need a little Linux server and 5-10 minutes of your time each three month. Or you can automate this. 

First of all, I want to share the "how it works" page of LE. https://letsencrypt.org/how-it-works/

My Setup. 

Internet - Sophos - Ubuntu 20.04 LTS
Ubuntu has "certbot" installed. Feel free to use other LE modules.
https://certbot.eff.org/ https://certbot.eff.org/lets-encrypt/ubuntubionic-apache
Follow straight the Guide for your OS. I am relying fully on those apps for the renewal process.  

Next, I am choosing the HTTP-01 method for LE, so I need a DNAT for LE to my Ubuntu.

(V18). 

PS: I am using HTTP DNAT for the renewal process and deactivate those Rules after the process. But you can also use only the LE IPs: 
https://community.letsencrypt.org/t/can-i-get-list-ip-from-letsencrypt/57117
PS2: You could switch to the DNS validation as explained in this Community thread.  

The next step would be to check your Domain. Your DNS A-Record should point to your WAN IP. Otherwise, this process won’t work. 
So perform a dig / nslookup of your domain. It’ll point to your WAN IP, so your DNAT will work, and HTTP packets will be forwarded to Certbot. 
You can also use the Sophos free DDNS service. https://community.sophos.com/kb/en-us/123126 

Certbot

Let us start Certbot and try it. 
My renewal process is straightforward:


(Be careful: LE blocks you after couple of "failed" requests for some time. So check everything).
Ultimately, you’ll get four files on your Linux: Public, Chain, Fullchain, Privatkey Certificates. 

Upload to Sophos Firewall

You’ll use this Public and Privatkey certificate. 
There are a couple of approaches to upload this to Sophos. 

The first LE Cert can be uploaded. 
You should use the Public.pem in "Certificate" and the Privatkey in "Privat key". 
PS: you have to rename the Privatkey.pem to Privatkey.key. Otherwise, Sophos won’t take this certificate. 

Optionally, you can upload the other Chain and fullchain Certificate under Certificate Authorities (Without Privat key). 
Now, you can use this Certificate for WAF/Webadmin. 

In case of renewal (each 90 Days), you have to choose a process.

Automation 

You can upload the new LE certificate with another Name and replace it in WAF/Webadmin. 
Or you can "update" the current LE certificate with the new public.pem / privat.key. But for this method, you have to switch to a fallback certificate in WAF/Webadmin, because Sophos can't update a currently used certificate.  

After all, those steps are manual processes every 90 Days. 
You can "script" this if you want to. So basically, upload the certificate every 90 Days to Sophos. 


Other members of the community have already performed scripts for this.

If you want to script this, this community can help you if you struggle with a point.
So please open a new thread with your issue with the API, and we’ll try to find a solution. 

Sophos Factory

Sophos Factory brings a new Tool to automate Script-based approaches. This means you can easily run a Script like Certbot or Lego in a Sophos Factory environment to generate and upload the certificate to the Sophos Firewall. 

Sophos Factory offers a free Community Edition. https://community.sophos.com/sophos-factory/ https://community.sophos.com/sophos-factory/b/release-notes-news/posts/get-started-here-sophos-factory-offer-automation-for-all-with-its-free-community-edition

Within Sophos Factory, it could look like this:

Each step is one scripting component.By using tools like Lego and Github, the "Pipeline" will run one time, generate the certificate and upload it to the Firewall. 

Contribution:
  https://zerossl.com/free-ssl/#crt Free alternative to this approach
For the Github script. 
 Thanks for the PHP Script! 
 for a Powershell Script with WAF integration. 
 for another version of a Powershell Script. 



Edited Links
[edited by: emmosophos at 10:23 PM (GMT -8) on 5 Mar 2024]
Parents Reply
  • in reply to Mateusz Bender

    It depends on the future of your implementation and investment into the security market. UTM is a standalone product while SFOS integrates into Central and other products from Sophos. See the future of IT security and the implementations, Sophos is going to do. (See Sophos Switches, ZTNA etc.). Most of those features will rely havely on a Sophos SFOS Appliance. 

    If LetsEncrypt is your only blocker, this could be easily replaced by purchasing a wildcard certificate for your domain. In SFOS you can simply generate a CSR, get this signed and you do not have to do anything for the next ~3 years. Personally i do not see LE as that blocker, as certificates are not that expensive in the first place. 

    __________________________________________________________________________________________________________________

Children
  • in reply to LuCar Toni

    We just need a powerful-enough firewall for our office. We don't have a huge datacentre or anything (a few internet facing services and small-scale internal AD-based Windows infrastructure), and the one and only reason I was even considering XG in the first place is because it's supposed to be faster than UTM. OK, that and it's marketed as the "next" cool thing. ;) Central is something we don't need at all (oh it sounds powerful... but seems completely wasted in our scenario).

    To make a switch to XG it needs to be:
    a) faster than UTM (it probably is?)
    b) I can't spend too much time configuring it to get our infrastructure to be in the same state as it currently is

    Lack of LE fails requirement b). Sure, I can get a wildcard certificate (not free, needs manual renewal every n-years). Or... I can do nothing and stay on UTM, at least until our network grows to the point where our small UTM hardware is no longer adequate. At which point we can try upgrading to XG or... get a more potent UTM, if XG still fails requirement b).

    To be absolutely truthful - the approach to designing rules in XG feels so... reversed from UTM that I'm having a hard time wrapping my head around it. (This is why I have an evaluation version to toy around with on a VM.) But that already makes me weary of migrating and then there're the little things like missing LE...

  • in reply to Mateusz Bender

    I cannot challenge more the issue only rely on a firewall for security. It is not and should not be your only line of defensive. I am talking about security and how to prevent spreading and XDR in his complete vision. 

    I am not here to get you to SFOS. That is not the purpos of this thread i can only tell you, there are attacks out there, which needs more then a simple firewall to prevent. Feel free to watch this summit: https://community.sophos.com/b/community-blog/posts/register-now-sophos-cybersecurity-summit-2021-december-1st or any cybersecurity Ressource out there. 

    __________________________________________________________________________________________________________________

  • in reply to LuCar Toni

    I need to make sure I understood you correctly.

    Did you just state that Sophos UTM does NOT offer sufficient security and is, in fact, a "simple firewall"?

  • in reply to Mateusz Bender

    Its about a IT security concept. A firewall is never be sufficient to totally protect a customer. Look out for the current IT threat landscape: https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophos-2021-threat-report.pdf 

    __________________________________________________________________________________________________________________

  • in reply to LuCar Toni

    The question was not, whether a firewall is sufficient, but WHY XG still misses vauluable UTM-Features (no LE-Support in XG after years) and why XG is so confusing for UTM-Admins.

    Thanks @LuCar Toni for his efforts to make a firewall for which Sophos charges a lot a bit better.

    Shame on Sophos for dropping UMT and replacing it with amateur style XG.

    @Mateusz Bender:
    Be aware, XG Executive Reports are far from being as informative as UTM short reports.
    Lots of pages, but to find out some background, about things you need to dive deep in log filtering.

  • in reply to JasmineMaier

    For Reports, check Central Reporting. This tool is far ahead of UTM. You can build reports at your own need and send them to everybody as you like. 

    __________________________________________________________________________________________________________________

  • in reply to LuCar Toni

    Hello, it is true Certificates are not that expensive. But max lifetime for new certificates is 12 month and the browser guys tending to even lower this cause of security. There is a need for certificate automation on XG/XGS. All my XG migrations with reverse proxy and heavy usage of Lets Encrypt are stopped. Sophos must deliver a solution for this.

  • in reply to Sven OlafSchuran

    What is the current use case for reverse proxy in this scenario? Could this be an ZTNA Scenario as well? 

    __________________________________________________________________________________________________________________

  • in reply to LuCar Toni

    webmail, some internal Services for external Users, direkt api access to internal systems for limited IPs, and so on.

    and it is not a good idea to tell the customer he should buy a second product, this stuff SG is able to do for years, and XG only half.

  • in reply to Sven OlafSchuran

    Did you look into ZTNA for those use cases? That is the future of SASE to be honest and it will replace plenty of services, currently handled by WAF. 

    It is not by buying a second product. It is to help the customer to get in touch with the future of security. 

    ZTNA can replace plenty of services like WAF, VPN. It will help in improving the overall security like micro segmentation etc. 

    www.sophos.com/.../zero-trust-network-access

    __________________________________________________________________________________________________________________

Unfiltered HTML