Sophos Firewall

First Name                      SMRU
Last Name                       IT
Business Email                  smru-it@shoklo-unit.com

Job role                        IT Director/Manager
Phone number                    055532026
Company                         SMRU
Industry                        Non-Profit
Company Size                    300
Country                         Thailand
Zip code/Postcode               63110
State/Province                  Tak

Activate your accounts

CREATE PASSWORD                 ********
CONFIRM PASSWORD                ********
ADDED SECURITY                  □ Make all admins sign in with multi-factor authentication
CENTRAL ADMIN PORTAL            United States

■ I acknowledge that (i) Sophos processes personal data in accordance with the Sophos Privacy Policy;
  (ii) the selected data storage region applies to the hosting location for the Central Admin protal only,
  and that data shared with Sophos may be processed in other locations; and (iii) the Central Admin portal
  data storage region cannot be changed once set up.

□ Enable sample submission. Certain Sophos products allow you to submit file samples to Sophos
  for improved security. We recommend enabling sample submission, but you my uncheck the box to disable it.

■ I have read, understand, and accept the terms of the Sophos End User License Agreement and/or
  Sophos Services Agreement, as applicable, and understand that they create legally binding obligations.

This will override the configured Appliance Access and allow access to all the services. All internet traffic will be dropped.
Appliance access enabled.

Appliance access disabled.

ERROR:  update or delete on table "tbladmin_service_access" violates foreign key constraint "tbladmin_service_rel_accessid_fkey" on table "tbladmin_service_rel"
DETAIL:  Key (id)=(3) is still referenced from table "tbladmin_service_rel".

ERROR:  update or delete on table "tbladmin_service_access" violates foreign key constraint "tbladmin_service_rel_accessid_fkey" on table "tbladmin_service_rel"
DETAIL:  Key (id)=(2) is still referenced from table "tbladmin_service_rel".

Rule name                       Admin console WAN access from MORU
Rule position                   Top
Description
IP version                      ● IPv4          ○ IPv6
Source zone                     WAN
Source Network /Host            MORU Public IP
Destination host                MST Public IP
Services                        HTTPS
Action                          ● Accept        ○ Drop

Hotspot                         SMRU_Guest
Hotspot voucher definitions     7Days
Amount                          20
Description                     Visitors - YYYY-MM-DD
Print                           OFF
Page size                       A4 (210x297 mm)
Vouchers per page               1
Add QR code                     OFF

Hotspot                         SMRU_Guest
Hotspot voucher definitions     180Days
Amount                          20
Description                     Staff - YYYY-MM-DD
Print                           OFF
Page size                       A4 (210x297 mm)
Vouchers per page               1
Add QR code                     OFF

<?xml version="1.0" encoding="UTF-8"?>
<Configuration APIVersion="1800.2" IPS_CAT_VER="1">
  <IPHost transactionid="">
    <Name>MST Local Network</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>Network</HostType>
    <IPAddress>10.10.1.0</IPAddress>
    <Subnet>255.255.255.0</Subnet>
  </IPHost>
  <IPHost transactionid="">
    <Name>MRM SSL VPN Network</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>Network</HostType>
    <IPAddress>10.10.9.0</IPAddress>
    <Subnet>255.255.255.0</Subnet>
  </IPHost>
  <IPHost transactionid="">
    <Name>SMRU-AD02</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>10.10.1.1</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>tbhf-anc-mrm</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>10.10.1.2</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>SMRU-SRV</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>10.10.1.3</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>SMRU-IT03</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>10.10.1.15</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>SMRU-DBP-MST</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>10.10.1.17</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>SMRU-DBD-MST</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>10.10.1.19</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>MRH Local Network</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>Network</HostType>
    <IPAddress>10.20.1.0</IPAddress>
    <Subnet>255.255.255.0</Subnet>
  </IPHost>
  <IPHost transactionid="">
    <Name>MKT Local Network</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>Network</HostType>
    <IPAddress>192.168.25.0</IPAddress>
    <Subnet>255.255.255.0</Subnet>
  </IPHost>
  <IPHost transactionid="">
    <Name>MLA Local Network</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>Network</HostType>
    <IPAddress>192.168.26.0</IPAddress>
    <Subnet>255.255.255.0</Subnet>
  </IPHost>
  <IPHost transactionid="">
    <Name>WPA Local Network</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>Network</HostType>
    <IPAddress>192.168.27.0</IPAddress>
    <Subnet>255.255.255.0</Subnet>
  </IPHost>
  <IPHost transactionid="">
    <Name>MSL Local Network</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>Network</HostType>
    <IPAddress>192.168.28.0</IPAddress>
    <Subnet>255.255.255.0</Subnet>
  </IPHost>
  <IPHost transactionid="">
    <Name>HPH Local Network</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>Network</HostType>
    <IPAddress>192.168.29.0</IPAddress>
    <Subnet>255.255.255.0</Subnet>
  </IPHost>
  <IPHost transactionid="">
    <Name>SKK Local Network</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>Network</HostType>
    <IPAddress>192.168.30.0</IPAddress>
    <Subnet>255.255.255.0</Subnet>
  </IPHost>
  <IPHost transactionid="">
    <Name>MKU Local Network</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>Network</HostType>
    <IPAddress>192.168.31.0</IPAddress>
    <Subnet>255.255.255.0</Subnet>
  </IPHost>
  <IPHost transactionid="">
    <Name>TST Local Network</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>Network</HostType>
    <IPAddress>192.168.32.0</IPAddress>
    <Subnet>255.255.255.0</Subnet>
  </IPHost>
  <IPHost transactionid="">
    <Name>tbhf-anc-mkt</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>192.168.25.2</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>tbhf-anc-mla</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>192.168.26.2</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>tbhf-anc-wpa</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>192.168.27.2</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>tbhf-anc-msl</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>192.168.28.2</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>SMRU-PMS-MKT</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>192.168.25.6</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>SMRU-PMS-MLA</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>192.168.26.6</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>SMRU-PMS-WPA</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>192.168.27.6</IPAddress>
  </IPHost>
  <IPHost transactionid="">
    <Name>SMRU-PMS-MSL</Name>
    <IPFamily>IPv4</IPFamily>
    <HostType>IP</HostType>
    <IPAddress>192.168.28.6</IPAddress>
  </IPHost>
</Configuration>

General settings
Name                            WAN-Port2
Hardware                        Port2
Network zone                    WAN
■ IPv4 configuration

IP assignmet                    ○ Static        ● PPPoE(DSL)    ○ DHCP
IPv4/netmask
Preferred IP

Gateway detail
Gateway name                    smru-sfw-<site>_WAN-Port2
Gateway IP                      128.0.0.1
Username                        ndno14657104@onnet.hp
Password                        ********
                                ********

Access concentrator/service name        /

□ LCP echo interval             Send LCP echo request every 20 seconds (5-180, default:20)
□ LCP failure                   Wait for LCP echo reply for 3 attempts (default:3)
Schedule time for reconnect     All days of the week 00 HH 00 MM

□ IPv6 configuration

DSL settings

□ VDSL
VLAN tag

Advanced settings

Interface speed                 Auto Negotiation
MTU                             1500
□ Override MSS                  1452
● Use default MAC address       ##:##:##:##:##:##
○ Override default MAC address

General settings
Name                            WAN-Port2
Hardware                        Port2
Network zone                    WAN
■ IPv4 configuration

IP assignmet                    ○ Static        ○ PPPoE(DSL)    ● DHCP
IPv4/netmask
Preferred IP

Gateway detail
Gateway name                    smru-sfw-<site>_WAN-Port2
Gateway IP                      128.0.0.1

General settings
Name                    LAN-br0
Hardware                br0
Description
                        ■ Enable routing on this bridge pair

Member interfaces
                        Interface               Zone
                        Port1                   LAN
                        Port3                   LAN
                        Port4                   LAN
                        Port5                   LAN
                        Port6                   LAN
                        Port7                   LAN
                        Port8                   LAN
                        Port9                   LAN
                        Port10                  LAN
                        Port11                  LAN
                        Port12                  LAN

■ IPv4 configuration
IP assignment           ● Static        ○ DHCP
IPv4/netmask            192.168.##.170/24(255.255.255.0)
Gateway detail
Gateway name
Gateway IP

□ IPv6 configuration

VLAN
□ Filter VLANs

SMRU-SFW-MRM    Port2-WAN-CAT   Active  If Not able to PING on IP address '8.8.8.8' Then "SHIFT to another available gateway"
SMRU-SFW-MRM    Port5-WAN-3BB   Backup  If Not able to PING on IP address '8.8.8.8' Then "SHIFT to another available gateway"

Rule name                       Default SNAT IPv4
Description                     Auto created IPv4 SNAT MASQ rule for traffic from "ANY" inbound interface to WAN outbound interface.
                                Updated automatically with WAN interface changes
Original source                 Any
Original destination            Any
Original service                Any
Translated source (SNAT)        MASQ
Translated destination (DNAT)   Original
Translated service (PAT)        Original
Inbound interface               Any
Outbound interface              WAN
                                WAN-3BB
                                □ Override source translation (SNAT) for specified outbound interfaces

Name                            youtube.com
Description
Classification                  Acceptable
Traffic shaping policy          None
Configure category              ● Local                 ○ External URL database
Import domain/keyword           Domain                  Keyword
                                Browse                  Browse
Domain/keyword                  youtube.com             youtube.com

Web proxy configuration

Web proxy listening port        8080
Allowed destination ports       21, 70, 80, 88, 210, 280, 443, 488, 550, 563, 591, 777, 800, 3001, 1025-65535

Message for block action

+ Use custom block message      Block message
                                SMRU IT has restricted access to sites categorized as {category}.
                                <br><br>If you think this is incorrect, you may contact SMRU IT <a>smru-it@shoklo-unit.com</a>.

DCOM was unable to communicate with the computer 169.254.207.210 using any of the configured protocols;
requested by PID 6b8 (C:\Program Files (x86)\Sophos\Sophos Transparent Authentication Suite\stas.exe).

DCOM was unable to communicate with the computer 10.10.1.163 using any of the configured protocols;
requested by PID 43d8 (C:\Program Files (x86)\Sophos\Sophos Transparent Authentication Suite\stas.exe),
while activating CLSID {8BC3F05E-D86B-11D0-A075-00C04FB68820}.

Mail Server settings

Send notifications via                  ○ Built-in email server ● External email server
Mail server IPv4 address/FQDN - Port    eu-smtp-outbound-1.mimecast.com
Authentication required                 ■
Username                                relay@shoklo-unit.com
Password                                ********
Connection security                     STARTTLS

Email settings

From email address                      smru-sfw-mrm@shoklo-unit.com
Send notifications to email address     it-notify@shoklo-unit.com
Management interface IP address         None

Name                    SMRU
Hardware                wlnet1
Description
SSID                    SMRU
Security mode           WPA2 Personal
Passphrase              ********
                        ********
Client traffic          Bridge to AP LAN

Name                    SMRU-Guest
Hardware                wlnet1
Description
SSID                    SMRU-Guest
Security mode           No Encryption
Client traffic          Bridge to AP LAN

Username:                       admin
Password:                       ********

Group name                      MRM SSL VPN group
Description
Group type                      Normal
Surfing quota                   Unlimited Internet Access
Access time                     Allowed all the time
Network traffic                 None
Traffic shaping                 None
SSL VPN policy                  MST SSL VPN policy
Clientless SSL VPN policy       No policy applied
L2TP                            ○ Enable        ● Disable
PPTP                            ○ Enable        ● Disable
Quarantine digest               ○ Enable        ● Disable
MAC binding                     ○ Enable        ● Disable
IPsec remote access             ○ Enable        ● Disable
Sign-in restriction             ● Any node      ○ Selected nodes        ○ Node range

Username                        John.vpn
Name                            John Smith
Description
User type                       ● User  ○ Administrator
Profile                         Profile
Password                        ********
                                ********
Email                           john@shoklo-unit.com
Group                           MRM SSL VPN group
Surfing quota                   Unlimited Internet Access
Access time                     Allowed all the time
Network traffic                 None
Traffic shaping                 None
SSL VPN policy                  MST SSL VPN policy
Clientless SSL VPN policy       No policy applied
IPsec remote access             ○ Enable        ● Disable       IP address
L2TP                            ○ Enable        ● Disable       IP address
PPTP                            ○ Enable        ● Disable       IP address
Quarantine digest               ○ Enable        ● Disable
MAC binding                     ○ Enable        ● Disable
MAC address list
Simultaneous sign-ins           ■ Use global setting    ■ Unlimited
Sign-in restriction             ○ Any node      ● User group node(s)
                                ○ Selected nodes        ○ Node range

Name                            MST Local Network
IP version                      ● IPv4  ○ IPv6
Type                            ○ IP    ● Network       ○ IP range      ○ IP list
IP address                      10.10.1.0       Subnet  /24(255.255.255.0)
IP host group

Name                            MST SSL VPN Network
IP version                      ● IPv4  ○ IPv6
Type                            ○ IP    ● Network       ○ IP range      ○ IP list
IP address                      10.10.9.0       Subnet  /24(255.255.255.0)
IP host group

General settings
    Name                                                MST SSL VPN policy
    Description

Identity
    Policy members                                      MRM SSL VPN group

Tunnel access
    Use as default gateway                              OFF
    Permitted network resources (IPv4)                  MST Local Network
    Permitted network resources (IPv6)

Idle time-out
    Disconnect idle clients                             OFF
    Override global time-out(Default 15 Minutes)

Authentication server list              Selected authentication server
                                        Local
■ Local

○ Same as VPN
○ Same as firewall
● Set authentication method for SSL VPN
Authentication server list              Selected authentication server
                                        Local
■ Local

protocol                        ● TCP   ○ UDP   (Select UDP for better performance)
SSL server certificate          ApplianceCertificate
Override hostname               smru-sfw-mrm.dyndns.org
Port                            8443
Assign IPv4 addresses           10.10.9.0       /24 (255.255.255.0)
Assign IPv6 addresses           2001:db8::1:0   /64
Lease mode                      IPv4 only
□ Use static IP adresses
IPv4 DNS                        10.10.1.1
IPv4 WINS
Domain name                     smru.shoklo-unit.com
Disconnect dead peer after      180 Seconds
Disconnect idle peer after      15 Minutes
Encryption algorithm            AES-256-GCM
Authentication algorithm        SHA2 256
Key size                        2048 bit
Key lifetime                    28800 Seconds
■ Compress SSL VPN traffic
■ Enable debug mode

Rule name                       Allow MST SSL VPN clients
Action                          Accept
■ Log firewall traffic
Description
Rule position                   Bottom
Rule group                      VPN traffic

Source zones                    VPN
Source networks and devices     MST SSL VPN Network
During scheduled time           All the time

Destination zones               LAN
Destination networks            MST Local Network
Services                        Any

■ Match known users             MRM SSL VPN group
                                □ Exclude this user activity from data accounting
□ Use web authentication for unknown users

Username:                       Douwe.vpn
Password:                       ********

C:\Program Files (x86)\Sophos\MST SSL VPN Client