Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=automatic-RED-setup

Set up a RED device automatically

You can create a tunnel between Sophos Firewall and a RED appliance automatically using the Sophos provisioning server.

How automatic provisioning works

Here's how the provisioning server sets up a RED tunnel with the firewall:

  1. You turn on the RED provisioning service in the firewall.
  2. You add the RED to the firewall by adding a RED interface.
  3. The firewall uploads the RED configuration to the Sophos provisioning server.
  4. The RED downloads the configuration from the provisioning server.
  5. The RED creates a tunnel with the firewall.

In this setup, the RED and firewall must have internet access.

Objectives

To set up a RED device automatically, do as follows:

  1. Add a custom zone for RED devices.
  2. Add a RED interface.
  3. Create a firewall rule for tunnel traffic.

Add a custom zone for RED devices

When adding the RED interface, if you've set the RED device in the LAN zone, the firewall applies the same rules to the RED device as the rest of the LAN network. To maintain a logical separation between the RED and LAN networks, add a custom zone for RED devices or use an existing zone, such as VPN or WiFi.

To add a custom zone for RED devices, do as follows:

  1. Go to Network > Zones and click Add.
  2. Enter a name for the zone. For example, RED.
  3. For Type, select LAN or DMZ. See Add a zone.
  4. For Device access, select the service you want for this zone.
  5. Click Save.

Add a zone for RED devices.

Add a RED interface

To create an interface for the RED, do as follows:

  1. Go to System services > RED and turn on the RED provisioning service.
  2. Go to Network > Interfaces, click Add interface, and select Add.
  3. Enter a branch name and select your RED device type.
  4. For Device deployment, select Automatically via provisioning service.
  5. Specify the other RED model settings as required.
  6. Under RED network settings, select the zone you created for RED devices.
  7. Click Save.

Create a firewall rule for tunnel traffic

You can configure firewall rules for RED devices based on their zones.

If you use an existing zone, previously created firewall rules determine how traffic is routed. Make sure the rules that apply to the selected zone don't break security for your internal networks. For example, the VPN zone prevents the firewall from resolving DNS requests. The VPN zone instead uses DHCP to distribute a different DNS server.

To create a firewall rule for tunnel traffic, do as follows:

  1. Go to Rules and policies > Firewall rules.
  2. Select IPv4 or IPv6, select Add firewall rule, and then select New firewall rule.
  3. For Source zones, select the zone you created for RED devices.
  4. Select a network in Source networks and devices if you want the firewall rule to match a network within the zone. Otherwise, select Any.
  5. For Destination zones, select LAN and WAN.
  6. Select a network in Destination networks if you want the firewall rule to match a network within the zone. Otherwise, select Any.
  7. Click Save.