Sophos Cloud UTM 9 Standalone or HA (BYOL)

We compare many WAFs that are available in AWS for our clients, and so far Sophos is the only product we've seen that is truly fit for cloud. It leverages the AWS services to provide a clean and elegant solution to autoscale Sophos instances in a highly available envrionment. We've deployed it in many client environments and have always seen a successful turn-out. It also provides a great solution to the AWS limitation of transitive routing to force outbound traffic to flow through the Sophos for inspection before reaching the Internet. Many of our clients have this requirement and so far Sophos is the only product in the market that provides an active/active solution to implementing GRE tunnels that push traffic across VPCs, through the Sophos, and out to the Internet. Additionally, their support team has been very helpful and are very responsive. They spend the time explaining their product and help you as you progress through every step of design, deployment, and implementation in your AWS environment.

We've been using the UTM in our VPC for a few months now. A few solid pro's for the product:

1. If you're coming from the Cisco ASA world (we were), you'll find the UTM interface incredibly simple. It makes common setup a breeze.
2. It supports a lot of stuff you wouldn't expect without extra cost (e.g. OTP soft tokens, a solid LDAP integration, Site2Site VPN, etc)
3. It's linux under the hood, so you can script certain things - even use tcpdump to analyze traffic.

Unfortunately, the product & company also have some huge drawbacks.

1. Sophos doesn't really care about it's documentation. As another user noted, the documentation provided by Sophos is just terrible. A good portion of it is plain wrong or outdated, and well over half of it is simply useless. An easy example is their documentation for HA support for EC2 (spoiler, they have no HA support for EC2, they have a rough idea of how somebody might do it).

2. A lot of the advanced features are too buggy to use in production. For example, if you want to use their web application firewall (similar to the IDS feature on the ASA), you're going to be manually adjusting Apache mod_security configs or deal with regular connection losses due exceptions. Don't bother reporting these issues to Sophos, due to #3.

3. When things go wrong, Sophos support is not there to help you. This wouldn't be as big of a deal if it wasn't for the documentation problem. When dealing with Sophos support, you get the very strong indication that you're really dealing with Windows AV tech support reps. Most of the time, the tech's don't have the slightest clue about what the UTM does or why. A few days (or weeks) after you file an issue, a properly trained tech may contact you, but who has that kind of time?

4. If you undergo PCI/HIPPA complaint scans, it's probably going to be the device with the most violations. You can report the violations to Sophos support, and they'll tell you to file a UTM feature request.

5. You just can't fix certain things. One of the best parts about the UTM is it's super-easy web interface. However, it completely lacks a command line interface into a lot of it's core features (NACLs, etc). If something misbehaves (e.g. needing to remove a stuck rule), you're down to scrounging the internet for some example of how somebody got Sophos support to give out a magic command.

So, if you're ok being on your own, then the UTM is a great starting point. Lots of good open source tools and it's not terribly difficult to poke around and figure out were they've configured most things.

There are virtually no instructions on the Sophos or Amazon web sites, beyond the video <http://www.sophos.com/en-us/lp/aws.aspx >. There is no advice on how to size the UTM VM instance and how it interacts with internal interfaces (virtual network cards). This lack of clear documentation is a major stumbling block when attempting to deploy UTMs in EC2. Personally I wasted over twenty hours, and was almost on the point of giving up when I was finally able to get a UTM working in EC2. Despite the fact I have access to Premium Support from Sophos, they offered almost no support on how to size and deploy a UTM in EC2. The support from Amazon was very spotty. The Amazon technicians I dealt with had never used a soft UTM and did not understand how they work, so I spent a lot of time educating them about the Sophos architecture. All in all, the product is fine but the obstacles to deploying it in EC2 are very daunting. In summary, the lack of documentation could make the Sophos UTM almost useless in the Amazon cloud. If you are brave enough to attempt to use this product, make sure you have phone support from Amazon.

The Sophos UTM is a very straight forward, easy to use appliance that does exactly what you want, GOOD IPS (Snort based), Stable VPN with very good interchangeability to AWS and other vendors plus lot more UTM features - HIGHLY RECOMMENDED

Emind has chosen Sophos UTM for lot's of our deployments.

Talk to us: info@emind.co  if you need more help.

Lahav Savir, Cloud Architect

This is a fairly easy solution for AWS VPC connectivity, although I did have to update the firmware before being able to effectively establish a VPN IPSec connection.

The interface is well thought out and is quick to respond to input.