Interesting Hardware Bug

Sophos, seriously?

https://support.sophos.com/support/s/article/KB-000037092?language=en_US

WTF?

That sounds to me like "never buy a Security Appliance from Sophos again"!

This is a feature, clearly explained in the Product description. https://www.sophos.com/en-us/medialibrary/PDFs/factsheets/sophos-sg-series-appliances-brna.pdf

Yes, but this is default behaviour and Firewalling and Bypass does not make any sense together.

Especially with default settings.

Its a hardware bypass within the hardware, if there is no power. So your suggestion would be to disable this feature per default? 

I cannot see any reason why a not running Firewall even without power plugged in should bypass traffic from Internet to internal network and vice versa.

If this is a hardware "feature", Sophos must change the hardware.

Most vendors offer such a feature for disaster cases. 

See: https://www.cisco.com/c/en/us/td/docs/security/Firewalls/ISA3000/hardware/ISA3000hwinst/hwbypass.pdf

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk85560

https://kb.fortinet.com/kb/documentLink.do?externalID=FD34937

Just to name a few.

The last links are not working, and that does not makes things better.

For a Firepower I can argue this, because this is usually running as an internal IPS.

But I would never do this with an Internet facing Firewall.

There is no reason!

XG/SG can be placed in such environment as well. Many customer use this product as a internal IPS. And hence this feature needs to be on the hardware in the first place, Sophos placed it in both products. You can disable it, if you want, as its programmable. 

I know. Will the settings in /sys filesystem be permanent, even if the system is down?

Usually this is not the case with /sys

Its programmable hardware. It will be affected for ever. 

OK, that is something.

I am working in IT-Security since 30 years but I have never seen this until today.

Default settings of any OS, espacially for Security systems, should be as secure as possible.

We don't have Security or networking specialists in every subsidiary.

Isn't this really designed more for an end-to-end feature, such as office to office connection that doesn't house external traffic?  I can see this as the only real option to use this, so long as its ultimately secured behind a DMZ, other existing firewall, etc., but not as an endpoint prior to external connectivity.  Gaining internet traffic off of this in a bypass mode capacity negates any security if I understand this setup correctly.

Isn't this really designed more for an end-to-end feature, such as office to office connection that doesn't house external traffic?  I can see this as the only real option to use this, so long as its ultimately secured behind a DMZ, other existing firewall, etc., but not as an endpoint prior to external connectivity.  Gaining internet traffic off of this in a bypass mode capacity negates any security if I understand this setup correctly.

What do you mean with "end-to-end" connection?

But for the rest I would agree!

And even for the behind a DMZ use case you mentioned, this must not be the default setting!

I'm referring to something like MPLS, and the provider can set it up so you have secure traffic from 'end to end' but internet flow traffic goes through a designated office.  

And, I never disagreed with you on it being a bad decision to have on as a default setting.

OK, I don't want to trust a MPLS provider as well. So even then there should be no bypass.