Sophos Firewall for AWS

Description

Sophos Firewall for AWS

Sophos Firewall for AWS extends Sophos network security into Amazon Web Services. It runs as a virtualized firewall on Amazon EC2 and can be positioned within an AWS VPC to inspect and secure network traffic.

The solution is available through AWS Marketplace and supports both BYOL and PAYG licensing. Organizations can therefore use existing Sophos licensing arrangements or select a usage-based AWS Marketplace option.

Cloud Network Security

Sophos Firewall provides security controls for AWS traffic, including stateful inspection, IPS, application control, web filtering, and other network security functions. These capabilities allow organizations to establish security policies around AWS workloads and applications.

The firewall can protect both inbound and outbound traffic in suitable AWS architectures. Sophos documentation specifically describes inline deployment within a VPC for scanning inbound and outbound traffic.

Application Protection

AWS-hosted applications can also benefit from Sophos Firewall’s Web Application Firewall capabilities. Sophos describes WAF protection against common web threats such as SQL injection and cross-site scripting, along with functions such as authentication offloading and path-based routing.

Deployment Flexibility

AWS Marketplace provides different Sophos Firewall deployment options, including standalone firewall deployments and options for high availability and Auto Scaling.

CloudFormation templates can simplify the deployment process by provisioning the firewall and associated AWS infrastructure.

Selection Guide

For Standard AWS Firewall Deployment

Choose the standalone Sophos Firewall for AWS deployment when you need a virtual firewall instance to protect workloads within an AWS VPC.

For Existing Sophos Licensing

Consider BYOL when your organization already has an eligible Sophos Firewall software license purchased through the Sophos partner network.

For AWS Marketplace Procurement

Choose PAYG when usage-based licensing through AWS Marketplace is preferred. Sophos Cloud Firewall PAYG is listed directly in AWS Marketplace.

For High Availability

Consider a supported HA architecture when the AWS security design requires firewall redundancy. Sophos Firewall supports active-passive and active-active HA modes.

For Dynamic Inbound Traffic

Consider the AWS Auto Scaling deployment when the requirement involves automatically adjusting firewall EC2 capacity for supported inbound traffic scenarios such as DNAT and WAF traffic.

Always Verify

Confirm the current Sophos documentation, AWS Marketplace listing, supported AWS region, licensing requirements, EC2 sizing, network architecture, and deployment prerequisites before purchasing or deploying.

Installation and Deployment Notes

Sophos Firewall for AWS is deployed through AWS Marketplace. The documented deployment process involves selecting the Sophos Firewall listing, accepting the software terms, selecting the fulfillment option, software version and AWS Region, and launching the provided CloudFormation template.

For an existing VPC, the deployment configuration can require the VPC ID, public subnet, private subnet, and Elastic IP configuration. CloudFormation then provisions the required resources.

After deployment, administrators can access the Sophos Firewall web administration console through the assigned public IP using HTTPS. AWS security group rules must be configured appropriately for management and other services that need access.

Before production deployment, plan the VPC topology, subnets, routing, security groups, EC2 sizing, licensing, management access, and traffic flows.

Best Practices

• Plan the AWS VPC and subnet architecture before deploying the firewall.
• Use the official Sophos AWS Marketplace listing and current deployment documentation.
• Select BYOL or PAYG based on the organization’s licensing and procurement requirements.
• Restrict firewall management access through appropriate AWS security group rules.
• Define inbound and outbound traffic requirements before creating firewall policies.
• Review EC2 sizing according to expected traffic and security inspection requirements.
• Use CloudFormation where appropriate to create repeatable deployments.
• Consider HA for environments where firewall redundancy is required.
• Use Auto Scaling only for supported deployment scenarios and traffic flows.
• Keep Sophos Firewall and AWS components updated according to supported release guidance.
• Document VPC routing, firewall interfaces, security groups, and Elastic IP assignments.

Benefits for IT Teams

Sophos Firewall for AWS provides IT teams with a dedicated virtual firewall for cloud environments while retaining Sophos security and management capabilities.

Key operational benefits include:

• Simplified AWS firewall procurement through AWS Marketplace.
• Flexible BYOL and PAYG licensing.
• Repeatable deployment through CloudFormation.
• Centralized security policy management.
• Visibility into network and application activity.
• Support for high-availability architectures.
• Scalable deployment options for supported AWS workloads.
• A consistent security platform across cloud and other network environments.

AWS Marketplace describes Sophos Firewall as combining network security controls, application and user controls, WAF, IPS, reporting, and centralized policy capabilities.

Main Benefits

AWS Network Protection

Sophos Firewall can be deployed inline within an AWS VPC to inspect traffic moving between external networks and protected cloud resources.

Benefit: Apply dedicated firewall security controls to AWS workloads.

Flexible Licensing

Sophos Firewall for AWS is available through BYOL and PAYG licensing models.

Benefit: Select a licensing approach that fits existing Sophos agreements or AWS procurement.

Advanced Threat Protection

Security capabilities include intrusion prevention, web filtering, application control, and other firewall security functions.

Benefit: Consolidate multiple network security controls within the firewall.

Automated Deployment

AWS CloudFormation templates can simplify the deployment of Sophos Firewall and associated AWS resources.

Benefit: Reduce manual configuration during cloud firewall deployment.

Application Security

Sophos Firewall provides Web Application Firewall functionality for protecting web applications against common threats, including SQL injection and cross-site scripting.

Benefit: Add application-layer protection to AWS-hosted applications.

Scalable Cloud Architectures

Supported AWS deployment options include Auto Scaling for dynamically adjusting firewall EC2 instances according to traffic load and events.

Benefit: Adapt firewall infrastructure to changing cloud traffic requirements.

Typical Use Cases

1. AWS VPC Security

Deploy Sophos Firewall inside an AWS VPC to inspect and control traffic between external networks and protected AWS workloads.

2. Inbound Application Protection

Use Sophos Firewall to protect AWS-hosted applications and services from unwanted inbound traffic and application-layer threats.

3. Outbound Traffic Security

Inspect outbound traffic from AWS workloads and apply firewall, web filtering, application control, and security policies.

4. Hybrid Cloud Connectivity

Use the virtual firewall as part of a security architecture connecting AWS resources with other networks and environments.

5. High-Availability Cloud Security

Use supported HA architectures when redundancy and reduced firewall downtime are important requirements. Sophos Firewall supports active-passive and active-active HA configurations.

6. Dynamic Cloud Environments

Use the AWS Auto Scaling deployment option for supported inbound traffic scenarios where firewall capacity needs to adjust with traffic load.

Who Should Buy Sophos Firewall for AWS?

Sophos Firewall for AWS is suitable for organizations that run applications, workloads, or network services on Amazon Web Services and require dedicated network security controls.

It can be considered by:

• Businesses running production workloads in AWS.
• Organizations operating hybrid cloud environments.
• IT teams protecting AWS-hosted applications.
• Managed service providers managing cloud security deployments.
• Enterprises requiring centralized firewall policies.
• Organizations needing BYOL or PAYG deployment options.
• Businesses requiring scalable cloud firewall architectures.

Related Categories

Explore related Sophos and cloud security solutions:

• Sophos Firewalls
• Sophos Cloud Firewall
• Sophos Firewall Virtual Appliances
• Sophos Firewall for VMware
• Sophos Firewall for Hyper-V
• Sophos Firewall for KVM
• Sophos Firewall for Nutanix
• Sophos Firewall for Citrix Hypervisor
• Sophos Firewall Software Appliance
• Sophos Firewall AWS solutions

Frequently Asked Questions

What is Sophos Firewall for AWS?

Sophos Firewall for AWS is a virtualized Sophos Firewall deployment that runs on Amazon EC2 and can be deployed within an AWS VPC to inspect and secure network traffic.

How can I buy Sophos Firewall for AWS?

Sophos Firewall for AWS is available through AWS Marketplace. Customers can use BYOL licensing purchased through the Sophos partner network or PAYG licensing purchased through AWS Marketplace.

Does Sophos Firewall for AWS support BYOL?

Yes. Sophos documents BYOL as an available licensing option for Sophos Firewall on AWS. AWS still charges for the EC2 infrastructure used to operate the firewall.

Does Sophos Firewall for AWS support PAYG?

Yes. Sophos Cloud Firewall PAYG is available through AWS Marketplace with usage-based software pricing. Additional AWS infrastructure costs may apply.

Can Sophos Firewall protect AWS inbound and outbound traffic?

Yes. Sophos documentation describes inline deployment within an AWS VPC to scan inbound and outbound traffic.

Does Sophos Firewall for AWS support WAF?

Yes. Sophos Firewall includes Web Application Firewall capabilities designed to protect web applications against common threats such as SQL injection and cross-site scripting.

Can Sophos Firewall for AWS scale automatically?

Sophos provides an AWS Auto Scaling deployment option that can automatically adjust the number of firewall EC2 instances according to traffic load and trigger events. The documented deployment is for PAYG and supports inbound scenarios such as DNAT and WAF traffic.

Does Sophos Firewall support high availability?

Sophos Firewall supports active-passive and active-active high availability. Active-passive provides redundancy, while active-active allows both devices to process traffic with Sophos’s documented load-balancing method.

How is Sophos Firewall deployed on AWS?

Sophos provides AWS Marketplace deployment options and CloudFormation templates. A typical deployment involves selecting the Marketplace listing, configuring the AWS Region and deployment parameters, and launching the CloudFormation stack.

Do I need to configure AWS security groups?

Yes. AWS security group rules are important for controlling management access and access to services such as VPN, user portal, WAF, or other firewall services. Sophos specifically notes that additional security group rules may be required beyond the default management access.