Sophos Firewall Central Orchestration

Sophos Central Orchestration is a dedicated licence that enables additional advanced features. It connects multiple Sophos Firewalls through Sophos Central over VPN in just a few clicks. Alongside VPN connectivity, the licence includes a light version of Sophos Fusion Firewall Reporting Advanced for enhanced reporting. The licence is also required to activate the MDR and XDR connector on Sophos Firewall. This licence gives you access to advanced features and services to strengthen your network security.

SD-WAN

As a security administrator, you know the challenges of manually creating VPN connections between multiple firewalls. Sophos Central Orchestration substantially simplifies this task. It lets you create VPN connections in seconds with a few clicks and manage complex network structures.

With Sophos Central Orchestration, you can quickly set up complex network structures such as full-mesh networks, hub-and-spoke topologies and tunnels. Beyond VPN connections, Sophos Central Orchestration offers SD-WAN features that improve network performance and resilience. You save time and effort while improving network performance and security.

Network topologies you can create with Sophos Central Orchestration:

Full-mesh networks: every device connects directly to every other device. Four firewalls require six separate VPN connections, calculated using n(n-1)/2, where n is the number of firewalls. Six firewalls require 15 connections, and ten require 45. This topology maximises redundancy and performance: devices send data directly to each other without an intermediate device.

Hub-and-spoke topologies: all devices connect to one central device, the hub. The hub handles communication between the individual spokes, or devices. With four firewalls, each connects only to the hub, requiring three VPN connections in total. Six firewalls require five connections, and ten require nine. This topology is easier to manage and needs fewer connections than a full-mesh network, but may offer less redundancy and performance because all data passes through the hub.

Tunnel configurations: private network data and communications travel securely over public networks such as the internet. Data is encrypted before transmission and decrypted on receipt to protect security and privacy. VPN connections are a common example of tunnelling. Sophos Central Orchestration lets you set up VPN tunnels between your firewalls easily and efficiently.

Sophos Central Orchestration makes managing VPN connections between multiple firewalls faster, simpler and more efficient. It simplifies administration while improving your network’s performance and resilience. With Sophos Central Orchestration, you can implement these and other network topologies quickly, with minimal complex configuration work.

Central Firewall Reporting Advanced (Light) – 30 days of logs

The Central Orchestration licence includes a light version of Sophos Fusion Firewall Reporting Advanced, a cloud-based reporting tool. It stores firewall data in Sophos Central for 30 days, giving you detailed insight into your network security.

Predefined reports on threats, compliance and user activity provide useful insight. Advanced options let you create and customise reports and views to suit your requirements. Sophos Fusion Firewall Reporting Advanced lets you save, schedule and export reports as needed.

Additional licensed storage in Sophos Fusion Firewall Reporting Advanced can extend the history available for reporting.

Central MDR and XDR connector

Central Orchestration also includes the Sophos XDR and MDR connector. It shares firewall data for cross-product Extended Detection and Response and the 24/7 Managed Threat Response service.

• Sophos MDR is an optional, fully managed service providing round-the-clock threat hunting, detection and response by Sophos experts.
• Sophos XDR provides advanced detection and response capabilities managed by your own team.

Whether Sophos handles threat hunting, detection and response or your own team does, your Sophos Firewall is configured to securely send the relevant threat data to the cloud.