Sophos Firewall

Schildmark can block attacking addresses on a Sophos Firewall from an alert, a policy rule or Schildmark Analyst. It keeps them in one IP host group that your own drop rules use. Schildmark adds and removes its own IP hosts in that group (athena-<ip>, one per blocked address) and never edits your rules.

Single IPv4 addresses only for now. This integration blocks; it is not Sophos Central (see Sophos Central). To collect the firewall's logs, send them by syslog (Firewall and network logs).

On the firewall

You need the firewall's admin console (usually port 4444) reachable from the Schildmark server.

1. API access. Under Backup & firmware → API, turn on API configuration and add the Schildmark server's address to the allowed addresses. If the Schildmark server reaches the firewall from its WAN side, also allow HTTPS admin access from that address in the device access settings.
2. IP host group. Under Hosts and services → IP host group, create a group called Schildmark-Blocked (or another name of your choice).
3. Drop rules. Under Rules and policies → Firewall rules, add two rules with action Drop above the rules that allow traffic:
   • Schildmark block - from: source networks Schildmark-Blocked, any destination.
   • Schildmark block - to: any source, destination networks Schildmark-Blocked.
4. API administrator. Create a dedicated administrator for Schildmark, not your own account. Its password cannot contain spaces, $, #, quotes or backquotes.

The group and the rules are yours: Schildmark only needs to read the group and add or remove its own members.

In the console

Admin → Integrations → Sophos Firewall:

Field	Notes
Firewall admin URL	The admin and API address Schildmark reaches, with its port, for example https://firewall.example.com:4444
API administrator	The administrator you created for Schildmark
Password	Never shown again once saved
Address group	The name of the group you created, for example Schildmark-Blocked. Left empty when you first set the integration up, Schildmark-Blocked is saved. An integration set up with an earlier release and this field left empty keeps using the group name that release used; enter a name to change it
Check the firewall certificate	Off by default, for the self-signed certificate firewalls ship with

Then Test connection: it signs in and reads the group (nothing is changed), and shows how many addresses the group holds. It tells you when the user name or password is refused, when the firewall does not accept API calls from this server, and when the group does not exist yet. Save applies the change within a minute, and the Block dialog then offers Block on Sophos Firewall. Admin → Platform health shows the firewall's state.

How a block works

• Block: Schildmark creates the IP host athena-<ip> in the group, with the block reason in its description. Blocking an address twice changes nothing.
• Unblock: Schildmark takes the host out of the group and deletes it.
• A protected address is never blocked.

Blocked addresses in the console

Response → Blocked IPs lists the group's members with the source Sophos Firewall. (Before 0.2.15 the page was shown only when AWS was also set up.)

• Schildmark's own entries show the reason they were blocked for, and can be unblocked from the console. The unblock is recorded like every other response action.
• Members you put in the group on the firewall show as Added on the firewall and cannot be unblocked from the console: Schildmark leaves them alone.

Every 15 minutes the stack also compares the group with the blocks and unblocks it has recorded, and reports any difference in its log. It only reads; it never adds or removes anything.