Sophos Migration Assistant. migration guide

Transcription

1 Sophos Migration Assistant migration guide

2 Contents Preface... 1 Prerequisites... 2 Convert SG/UTM configuration to Sophos XG Firewall-compatible configuration... 3 Reimaging and applying configuration...8 Reimage Sophos SG/UTM to Sophos XG Firewall... 8 Apply Sophos XG Firewall configuration on the reimaged box... 8 Appendix A: Conversions and limitations... 9 Appendix B: Improvements Appendix C: Download UTM configuration...11 Appendix D: Sophos SG/UTM modules: Migration status...12 Appendix E: Install Sophos Migration Assistant on Oracle VM VirtualBox Appendix F: View and resolve exception list...30 tice...32 (2019/01/17)

3 1 Preface This guide describes how to migrate from Sophos SG/UTM to Sophos XG Firewall. It enables you to do the following: Convert your Sophos SG/UTM configuration (on version 9.4 or later) on SG series and virtual/ software appliances to Sophos XG Firewall-compatible configuration (v16 or later). Reimage your Sophos SG/UTM appliance tosophos XG Firewall. Upload the Sophos SG/UTM license file. Upload the converted Sophos XG Firewall configuration file. 1

4 2 Prerequisites Hardware compatibility SG: SG series hardware appliances support Sophos XG Firewall. UTM appliance: If you have a SG/UTM series appliance, you need to upgrade the hardware. Contact your Sophos Partner or Sophos representative. Virtual or Software appliance: Appliances with 2 GB RAM or higher support Sophos XG Firewall. Firmware version Sophos Migration Assistant allows you to convert configuration backup for SG/UTM appliances on version 9.4 or later. Data backup UTM configuration backup. Refer to Appendix C: Download UTM configuration (page 11). License file backup Logs from your SG/UTM appliance Number of interfaces Number of SG/UTM interfaces should not be more than those supported on the Sophos XG Firewall appliance. 2

5 3 Convert SG/UTM configuration to Sophos XG Firewall-compatible configuration 1. Install Sophos Migration Assistant on a virtual machine. For more information, refer to Appendix E: Install Sophos Migration Assistant on Oracle VM VirtualBox (page 22). 2. In Oracle VM VirtualBox, click Start and enter admin as password to login. 3. Go to and log in with the following credentials: 3

6 Username: (Default) admin Password: (Default) admin 4. Accept the terms of service and then click Next. A screen appears listing the category and its sub-category along with the configuration that gets migrated. Click Next. 5. (Optional) Go to admin > About product from top right corner of the screen if you wish to see the product information. 6. (Optional) Click Firmware management to see and configure the available firmware version. 4

7 7. Click Start New Migration to begin migration. For previous migration sessions, you can manage the following: Continue migration, download logs, view migration logs, view audit logs, and discard migration. 8. Upload the Sophos UTM configuration file. a) Enter a session name and description. b) Click Choose File and upload the Sophos UTM configuration file. c) Enter password for the Sophos UTM configuration file (if the file is encrypted). To download the Sophos UTM configuration file, refer to Appendix C: Download UTM configuration (page 11). 9. Click Next to start migration. The following screen appears: 5

8 Sophos Migration Assistant auto-migrates Sophos UTM configuration for the supported modules. For more information, refer to Appendix D: Sophos SG/UTM modules: Migration status (page 12). You can skip the next step, if you do not have any exception. 10. Click Continue with exception handling to resolve the exceptions. The number of exceptions (errors or warnings) is displayed. You must resolve these conflicts manually to complete the migration process. To view and resolve exceptions, refer to Appendix F: View and resolve exception list (page 30). 11. Click Download migrated config to download the configuration file converted from Sophos SG/ UTM to Sophos XG Firewall. The downloaded file will be of device.backup file extension. 6

9 Conversion of Sophos SG/UTM configuration to Sophos XG Firewall-compatible configuration is complete. 7

10 4 Reimaging and applying configuration Before reimaging the production Sophos SG/UTM appliance, it is recommended that you take advantage of the free 30-day trial for Sophos XG Firewall. To test the migration and configuration, you can set up a parallel virtual or software instance. 4.1 Reimage Sophos SG/UTM to Sophos XG Firewall After you downloaded the Sophos XG Firewall configuration, you need to prepare your Sophos SG/UTM device for migration. Reimage your SG/UTM appliance and install Sophos XG Firewall on it. For details, refer to the articles and community.sophos.com/kb/en-us/ To migrate the Sophos SG/UTM license to Sophos XG Firewall license, you need to upload the UTM configuration file on the reimaged Sophos XG Firewall device. High-availability setups (HA) If you have an HA setup, re-image both devices and then deploy the migrated configuration to one of the devices. The second device receives its configuration from the migrated device during synchronization after the HA configuration. For more information on HA configuration refer to the following guides: Active-active: Pocket-Guides/Active-Active-HA-Configuration.pdf?la=en. Active-passive: SophosFirewall/Pocket-Guides/Active-Passive-HA-Configuration.pdf?la=en. 4.2 Apply Sophos XG Firewall configuration on the reimaged box 1. Log in to Sophos XG Firewall Admin Console as administrator with Read-Write permissions for the relevant features. 2. Go to System > Backup & firmware > Backup & restore. 3. Click Choose file and select the converted Sophos XG Firewall configuration file. Reimaging and applying configuration is complete. For more administrative configuration, refer to Sophos XG Firewall web interface reference and admin guide. 8

11 5 Appendix A: Conversions and limitations The following conversions will take place for the entities during migration from Sophos SG/UTM to Sophos XG Firewall: Maximum character length supported in Sophos XG Firewall is less than that supported in SG/ UTM: Value will be trimmed to the upper limit supported in Sophos XG Firewall. Duplicate records in SG/UTM (Sophos XG Firewall does not support duplicate records): Unique number will be added as suffix to the name of the entity. Value is valid in Sophos SG/UTM but not in Sophos XG Firewall: Value of the entity will be set to its default value in Sophos XG Firewall. Entity is not mandatory in Sophos SG/UTM but is mandatory in Sophos XG Firewall: Value of the entity will be its default value in Sophos XG Firewall. Firewall rule numbering: In SG/UTM, firewall rules are numbered in the order in which they are applied to traffic (i.e. according to their priority). In Sophos XG Firewall, firewall rules are numbered in the order of their creation. There are some limitations to what can be (automatically) configured. For example, there are some settings that are mandatory in Sophos XG Firewall which were not in SG/UTM. In this case, you will get an exception which you need to resolve during the exception handling stage. Here are some examples: Hostname must not contain a space or special character. VLAN on bridge interfaces are not supported by Sophos XG Firewall. Static IP-MAC binding in the range of DHCP IP scope is not supported by Sophos XG Firewall. SNMP: Location is mandatory in Sophos XG Firewall. IPv6 in L2TP is not supported in Sophos XG Firewall. Group attribute in RADIUS server configuration is mandatory in Sophos XG Firewall. 9

12 6 Appendix B: Improvements Improvements: MR1 10 Profiles that are configured with a single event schedule will be migrated for All days of the week. For all web categories, the Override Default tification page will be disabled. System zone configured under Network > Zone is migrated as is. When you delete a VLAN host in Sophos XG Firewall, the VLAN host-based firewall rules are deleted. Special characters in DHCP server hostname are replaced with _.

13 7 Appendix C: Download UTM configuration 1. Sign in to Sophos UTM Web Admin console. 2. In Management, click Backup/Restore. 3. In Create Backup, click Create backup now. Migration is supported only on full backups. Do not select the following options while creating backups: Unique site data (License, passwords, certificates/keys, endpoints) Administrative mail addresses Available backups will appear in a list. 4. Click the download button to download the configuration file. 5. Click Download backup to download the configuration file. The downloaded configuration file will have.abf file extension. te If you select Encrypt before downloading, the configuration file will have.ebf extension. 11

14 8 Appendix D: Sophos SG/UTM modules: Migration status For the current release, the following components from the Firewall section are not supported for migration: SUM user-created firewall rules. SUM automatic firewall rules. Automatic firewall rules. Section Sub-section Is migrated? System settings Organizational Hostname Shell access Scan settings Scan settings > Antivirus engine Preferences Scan settings > Advanced threat protection options Scan settings > Antispam engine preferences Reset configuration General > WebAdmin language General > WebAdmin access configuration Access control > Role User preferences Licensing Licensing Up2Date Overview Configuration Advanced Backup/Restore Automatic backups Global Advanced > Language Advanced > Security WebAdmin settings Backup/Restore User portal Advanced > Disable portal items Advanced > Network settings 12

15 Section Sub-section Is migrated? Advanced > Welcome message Global tifications Advanced Global > Company logo Global > Custom company text Web messages > End user messages Web messages > administrator information Web templates messages Query Traps Central Management Sophos UTM Manager Sophos Mobile Control Sophos Mobile Control HA / Auto-scaling Configuration Definition & users > Service definitions ESP AH Local ne Remote Static members IPsec X509 DN mask Backend membership Global settings (Automatic user creation) Single sign-on OTP tokens OTP settings Active Directory group Membership synchronization Prefetch directory users tifications Customization SNMP Definition & users > Users & groups > Users Definition & users > Users & groups > Groups Definition & users > Authentication Services Definition & users > Authentication services > OTP Definition & users > Authentication services > Advanced 13

16 14 Section Sub-section Is migrated? Definition & users > Client authentication Client authentication options Other Interfaces & routing > Interfaces > Interfaces PPPOA/PPTP Interfaces & routing > Interfaces > Interfaces 3G/UMTS Interfaces & routing > Interfaces > Interfaces Modem (PPP) Interfaces & routing > Interfaces > Interfaces Ethernet bridge Interfaces & routing > Interfaces > Interfaces DSL (PPPoE) Interfaces & routing > Interfaces > Interfaces Group Interfaces & routing > Interfaces > Link aggregation Link aggregation Interfaces & routing > Interfaces > Multi-path rules Multi-path rules Interfaces & routing > Interfaces Status Interfaces & routing > QoS Status Interfaces & routing > QoS > Traffic selector Traffic selector Application selector Group Interfaces & routing > QoS > Bandwidth pool Bandwidth pool Interfaces & routing > QoS > Download throttling Download throttling Interfaces & routing > QoS > Advanced Advanced Interfaces & routing > Uplink monitoring Global Interfaces & routing > Uplink monitoring > Actions IPsec tunnel Interfaces & routing > Uplink monitoring > Actions Additional address Interfaces & routing > IPv6 Global Renumbering 6to4 Tunnel broker

17 Section Sub-section Is migrated? Interfaces & routing > Static routing > Standard static routes Blackhole route Interfaces & routing > Policy routes Interface route Gateway route Global Area > rmal Area > Stub Area > NSSA Area > Stub - summary Area > NSSA - summary Interfaces Message digests Debug Advanced (Redistribution) Global Systems Neighbor Route map Filter list Advanced Routes > Gateway route Routes > Interface route Advanced Global Static entries DHCPv6 relay Static mappings IPv4 lease table IPv6 lease table Server status NTP Options Country blocking Interfaces & routing > Dynamic routing (OSPF) Interfaces & routing > BGP Interfaces & routing > Multicast routing (PIM SM) Network services > DNS Network services > DHCP Network services > NTP Network protection > Firewall > Country blocking 15

18 Section Sub-section Is migrated? Network protection > Firewall > Country blocking exceptions Country blocking exceptions Network protection > Firewall > ICMP Global ICMP settings Ping settings Traceroute settings Connection tracking helpers Protocol handling Logging options Network protection > NAT > Masquerading Masquerading Network protection > NAT > NAT > Rule SNAT (source) DNAT (destination) 1:1 NAT (whole networks) Full NAT (source + destination) NAT Network protection > Intrusion prevention > Global Global IPS settings Network protection > Intrusion prevention > Attack patterns Attack patterns Network protection > Intrusion prevention > Anti-DoS/Flooding TCP SYN flood protection UDP flood protection ICMP flood protection Network protection > Intrusion prevention > Anti-port scan Portscan detection Network protection > Intrusion prevention > Exceptions Exceptions Network protection > Intrusion prevention > Advanced Pattern set optimization Manual rule modification Performance tuning Network protection > Firewall > Advanced 16 Network protection > Server Check type: TCP load balancing > Balancing rules Check type: UDP Check type: Ping Check type: HTTP Host

19 Section Sub-section Is migrated? Check type: HTTPS Host Network protection > VoIP > SIP Global SIP settings Network protection > VoIP > H.323 Global H.323 settings Network protection > Advanced > Generic proxy Generic proxy Network protection > Advanced > Socks proxy SOCKS proxy options Network protection > Advanced > Ident reverse proxy Global settings Web protection > Web filtering > Default web filter profile Global Web protection > Web filtering > HTTPS scan settings HTTP Web protection > Web filtering > Active policies policies Web protection > Web filter profiles > Filter profiles Web filter profiles HTTPS Policies Web protection > Filtering options > Exceptions Exceptions list Web protection > Filtering options > Websites Websites Web protection > Filtering options > Bypass users Bypass blocking Web protection > Filtering options > PUAs Potentially unwanted applications authorization Web protection > filtering options > Categories Filter category list Web protection > Filtering options > HTTPS CA Signing CA Verification CAs Misc settings Transparent mode skiplist Proxy auto configuration Web protection > Filtering options > MISC URL categorization parent proxy Web caching Streaming settings 17

20 Section 18 Sub-section Is migrated? Transparent mode Active Directory single sign-on Apple OpenDirectory single sign-on Certificate for end user pages Pharming protection Web protection > Policy helpdesk > Policy test Request details Web protection > Policy helpdesk > Quota status Quota status Web protection >Application control > Network visibility Flow monitor Web protection > Application control > Application control rules Application control rules Web protection > Application control > Advanced Application control skiplist Web protection > FTP > Global FTP settings Web protection > FTP > Antivirus Antivirus scanning File extension filter Web protection > FTP > Exceptions Exceptions list Web protection > FTP > Advanced FTP proxy skiplist FTP Servers protection > SMTP SMTP protection > SMTP profiles SMTP profiles protection > POP3 POP3 protection > Encryption Encryption protection > SPX Encryption SPX Encryption protection > Quarantine Report Quarantine report protection > Mail manager Mail manager Advanced protection > Sophos Sandstorm Sophos Sandstorm Advanced protection > Advanced Threat Protection Advanced Threat Protection

21 Section Sub-section Is migrated? Wireless protection > Global settings > Global settings Global settings Wireless protection > Global settings > Advanced Global settings Wireless protection > Wireless networks Wireless networks Wireless protection > Access points Access points Wireless protection > Mesh networks Mesh networks Wireless protection > Wireless clients Wireless clients Wireless protection > Hotspots > Hotspots Hotspots Wireless protection > Hotspots > Voucher definition Voucher definition Wireless protection > Hotspots > Advanced Advanced Web server protection > Web appliance firewall Web appliance firewall Web server protection > Reverse authentication Reverse authentication RED management > Global settings RED global settings RED management > [Server] Client management [Server] Client management RED management > [Server] Deployment helper [Server] Deployment helper RED management > [Client] Tunnel management [Client] Tunnel management Site-to-site VPN > Amazon VPC Amazon VPC Site-to-site VPN > Certificate management > Advanced Regenerate signing CA Site-to-site VPN > Ipsec > Local RSA Key Re-generate local RSA key. Site-to-site VPN >IPsec > Advanced Dead Peer Detection (DPD) CRL handling Site-to-site VPN > IPSec > Debug IKE debugging Site-to-site VPN > SSL > Connections SSL server 19

22 Section Site-to-site VPN > SSL > Settings Site-to-site VPN > SSL > Advanced Is migrated? SSL client Server settings Virtual IP pool Duplicate CN Cryptographic settings Compression settings Debug settings Remote access > SSL > Profiles Remote access profiles Remote access > SSL > Settings Server settings Virtual IP pool Duplicate CN Cryptographic settings Compression settings Debug settings Main settings Remote access > SSL > Advanced Remote access > PPTP > Global Remote access > PPTP > ios ios settings devices Remote access > PPTP > Advanced Encryption strength Debug mode Remote access > L2TP Over IPsec > ios devices ios settings Remote access > L2TP over IPsec > Advanced IKE debugging L2TP debugging Dead Peer Detection (DPD) CRL handling Remote access > IPsec > Debug IKE debugging Remote access > HTML5 VPN portal HTML5 VPN portal Remote access > Cisco VPN portal > Global Server settings Remote access > IPsec > Advanced 20 Sub-section

23 Section Sub-section Is migrated? Remote access > Cisco VPN portal > ios devices ios settings Remote access > Cisco VPN portal > Debug IKE debugging 21

24 9 Appendix E: Install Sophos Migration Assistant on Oracle VM VirtualBox 1. Click New in Oracle VM VirtualBox and enter the following: Name: Enter a name for VM. Operating System: Select Linux. Version: Select Linux 2.6 (64 bit). 2. Set the base virtual memory (vram) to 2 GB or higher. 3. Select the following to set the start-up disk size: 22 Start-up Disk Create new hard disk

25 a) Select File type as VMDK (Virtual Machine Disk). b) Set Storage details to Dynamically allocated. c) Set the disk size to 32 GB or higher. d) View summary and click Create. 4. Click Settings > Storage. Select the Sophos Migration Assistant image file (ISO). a) Click Settings > Network and set the following: Attached to: Host-only Adapter 23

26 Name: Select the host-only adpater from the list. Promiscuous Mode: Deny b) (Optional) Go to Files > Preferences > Network. Click Add. Enter the IP address and mask, if you have not configured a network in your host system. 24

27 5. Click Start to proceed with the installation. a) Enter y to continue with installation. 25

28 b) Remove the ISO file, which you have added. c) Enter y to reboot when prompted after the installation. 26

29 6. Click Start to login after installation and to access Sophos Migration Assistant. For password, enter admin. 7. (Optional) To set a new interface address (update default interface address), log in with the administrator password as discussed earlier. a) In console, Enter 1 for network configuration. b) Again, enter 1 for interface configuration. 27

30 A screen displaying IP addresses for both Port A and Port B appears. c) Enter y to proceed and change the IP address. d) Similarly, follow the on-screen instructions for netmask and gateway IP address. 28

31 To change the default administrator password, you can select option 2 System Configuration from the main menu and proceed with the on-screen instructions. For other VMs, refer to the following: Sophos XG Firewall Virtual Appliance Microsoft Hyper-V: %20Started%20Guide%20-%20Hyper-V.pdf. Sophos XG Firewall Virtual Appliance - KVM: vm-guides/sophos%20xg%20firewall%20virtual%20appliance%20-%20getting%20started %20Guide%20-%20KVM.pdf. Sophos XG Firewall Virtual Appliance XenApp: vm-guides/sophos%20xg%20firewall%20virtual%20appliance%20-%20getting%20started %20Guide%20-%20XenApp.pdf. 29

32 10 Appendix F: View and resolve exception list The list of unsolved exceptions with the reason for error or warning is displayed. Exceptions are of two types and must be resolved manually: Errors: Conflicts between Sophos SG/UTM and Sophos XG Firewall configurations. Warnings: Migrated configuration entities, which pose a connectivity or security risk. Exception handling Click Resolve (appears against errors) against the exception to resolve it. Sophos XG Firewall configuration page for the particular entity will be displayed. Details of the exception appear to the far-right. Change the configurations to resolve the exception based on your requirement. If you are an advanced user, you can update configurations in Preview XG configuration (For advanced users). Click Accept (appears against warnings) to accept migration of the entity. Logs handling Click View logs for details of the migrated configuration. Click Download logs if you wish to: Trace the resolved exceptions for troubleshooting. Send them to Sophos Support if you require help. Refer to resolved exceptions later in offline mode. Preview XG configuration (for advanced users) Preview XG configuration appears for advanced users. Click this to preview and add a configuration in the modules supported for migration. Configuration changes that you make here will be applied in the converted Sophos XG Firewall configuration file. 30

33 Click Close preview to go back to configure the exceptions. To filter the logs, select any of the options under Show status: Auto-migrated Accepted Auto-resolved Resolved Deleted Unresolved All 31

34 11 tice Copyright 2019 Sophos Limited. All rights reserved. part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner. Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners. 32