Sophos Firewall PowerShell Module Suite

A PowerShell module collection for managing Sophos XGS/SFOS firewalls through their XML management API. Twenty modules ship 668 cmdlets, covering twenty of the API's areas.

Quick Start

# 1. Install from the PowerShell Gallery (SophosFirewall.Core is pulled in automatically)
Install-Module SophosFirewall.HostsAndServices -Repository PSGallery -Scope CurrentUser

# 2. Connect to the firewall
$cred = Get-Credential
Connect-SfosFirewall -Firewall '192.0.2.10' -Port 4444 -Credential $cred -SkipCertificateCheck

# 3. Use the cmdlets
Get-SfosIPHost
New-SfosIPHost -Name 'Server1' -HostType IP -IPAddress '192.0.2.50'

Multiple firewalls at once

Every cmdlet accepts -Session - a session object returned by Connect-SfosFirewall, or the name of a session registered with -Name. That makes moving objects between two firewalls a one-liner:

$fw1 = Connect-SfosFirewall -Firewall '192.0.2.10' -Credential $cred1 -Name fw1
$fw2 = Connect-SfosFirewall -Firewall '192.0.2.20' -Credential $cred2 -Name fw2 -NoDefault

Get-SfosIPHost -Session $fw1 -NameLike 'Server1' | ForEach-Object {
    New-SfosIPHost -Name $_.Name -HostType $_.HostType -IPAddress $_.IPAddress -Session $fw2
}

Get-SfosSession                  # list registered sessions (IsDefault marks the ambient one)
Disconnect-SfosFirewall -All     # drop everything

Cmdlets called without -Session use the ambient default session set by Connect-SfosFirewall.

Modules

Module	Cmdlets	Purpose
SophosFirewall.Core	15	Connection management, API transport, XML escaping
SophosFirewall.HostsAndServices	53	IP/FQDN/MAC hosts, country groups, services and their groups
SophosFirewall.Web	54	URL groups, web categories, file types, filter policies and exceptions, surfing quotas
SophosFirewall.Firewall	21	Firewall rules and rule groups, NAT rules, SSL/TLS inspection
SophosFirewall.Network	100	Interfaces, VLANs, zones, gateways, DNS, DHCP, ARP, tunnels
SophosFirewall.Authentication	97	Authentication servers, users and groups, guest/clientless users, OTP, admin/VPN/web authentication, captive portal, Azure AD SSO, STAS, live users
SophosFirewall.Routing	31	Gateways and health checks, SD-WAN, static and multicast routes, PIM
SophosFirewall.VPN	51	IPsec connections and profiles, SSL VPN, L2TP, PPTP, failover groups
SophosFirewall.IntrusionPrevention	30	IPS policies and rules, custom signatures, DoS settings, spoof prevention, trusted MACs
SophosFirewall.ActiveThreatResponse	10	ATP threat feeds, host/threat exceptions, third-party threat feeds
SophosFirewall.Applications	20	Application filter policies and rules, application objects, categories, classification
SophosFirewall.SystemServices	21	QoS policies, syslog servers, the system service daemon manager, High Availability, RED
SophosFirewall.Administration	34	Notification, SNMP, appliance access, admin/web-admin settings, time, messages, Netflow, local service ACL, restart/shutdown
SophosFirewall.Profiles	20	Schedules, access time policies, data transfer policies, decryption profiles, administration profiles
SophosFirewall.WebServer	18	Web server publishing (WAF), protection policies, authentication policies and templates, slow HTTP protection
SophosFirewall.Certificates	11	Certificates, certificate authorities, revocation lists
SophosFirewall.Email	70	SMTP and POP/IMAP scanning policies, MTA address groups and exceptions, data control, SPX, anti-spam, mail configuration
SophosFirewall.Diagnostics	8	Remote support access, web console log viewer access, log capture to file
SophosFirewall.ZeroDayProtection	2	Sandbox analysis datacenter and excluded file types
SophosFirewall.SophosCentral	2	Sophos Central cloud management switches (reporting, management, configuration backup)

668 cmdlets in total. Every module follows the same connection model and shares the SophosFirewall.Core transport layer.

Several cmdlets change settings that the current management session itself depends on - appliance access, admin authentication, interfaces and zones, spoof prevention, HA. A wrong value there can end the session with no way to reconnect. Every write cmdlet in the suite supports -WhatIf; each module's README names the cmdlets that carry this risk and how to use them safely.

Requirements

• PowerShell 5.1 or 7.x
• HTTPS access to the firewall's management API (default port 4444)
• A firewall account with API access

Architecture

Two layers:

• SophosFirewall.Core owns the connection, the HTTP transport, XML escaping and status evaluation. It has no knowledge of any specific object type.
• Domain modules (everything else) build the inner request XML for their own object types, parse the response, and expose the Get-/New-/Set-/Remove- cmdlets. They never call the firewall directly; they go through SophosFirewall.Core.

Every write cmdlet supports -WhatIf/-Confirm. Every value taken from a caller is XML-escaped before being sent. Get-* cmdlets accept pipeline output from other Get-* cmdlets so objects can be copied between firewalls with Get-* -Session $fw1 | New-* -Session $fw2.

License

MIT License - Copyright (c) 2025 Jan Weis

Links

• Changelog
• Sophos Firewall API Documentation