Sophos Universal Reader and Finder (SURF)

SURF, or the Sophos Universal Reader and Finder, is a fantastic troubleshooting tool for Sophos Endpoint and Firewall. SURF provides easy access to Sophos support log bundles contents, extracting summary data and providing a search capability for the contained logs. SURF also identifies known issues and serves up links to Sophos knowledge base articles with helpful instructions should an issue is discovered.

The tool was released today and it looks cool,  its available to Sophos Partners and it looks like it would cut down on 1st line support time as it can pick out all the errors and identify know issues / fix's.

Works on Sophos AV SDU logs and Sophos XG CTR files

Available from here Tech Tools (sophos.com)

More information here Introducing SURF! - Sophos Techvids

Sophos XG SIP/H.323 Voip Call issues

If your PBX is on site and your having issues with the SIP Trunk, I would recommend disabling SIP ALG on the Sophos unit

More details

But if your PBX is hosting on the "cloud" and your having odd issues like calls dropping out and park bays disconnecting, I would recommend the following changes

You will need to putty in to the unit and connect to the device console for all the following

1. For good measure disable SIP ALG
2. type "system system_modules h323 unload" (Only need if its not SIP but H323)
3. type "set advanced-firewall udp-timeout-stream 150"
4. type "set ips sip_preproc disable" (Only needed if IPS is enabled or Site-to-Site VPN)
5. type "set vpn conn-remove-tunnel-up disable" (Only needed if IP Sec VPN are used)

I would test each step to see if one fixes it instead of just blasting it all at once and see what happens.

Sophos XG Firewall: VoIP calls may drop or encounter poor quality

Sophos XG Firewall: Audio and video calls are dropping or only work one way when H.323 helper module is loaded.

Sophos XG Firewall: Session Initiation Protocol (SIP) Support

Disable Sophos XG SIP ALG

1. Log in to the CLI using Telnet or SSH. You can also access the CLI from admin > Console in the upper right corner of the Admin Console screen.
   
   
2. Choose option 4. Device Console.
   
   
3. Run the following command:
• console> system system_modules sip unload

Note

If you wish to reload the SIP ALG do step 1 & 2 and change step 3 to load instead of unload

Sophos XG Firewall: Session Initiation Protocol (SIP) Support

Restart Sophos XG Web Admin

1. SSH in to the unit with admin details
2. Press "5. Device Management"
3. Press "3. Advanced Shell"
4. Type "service tomcat:restart -ds nosync"

If this fails try resetting the Web Admin SSL Certificate

1. SSH in to the unit with admin details
2. Press  "2.  System   Configuration"
3. Press "4.  Reset Default Web Admin Certificate"