Hi everyone, new here. I'm trying to get a handle on Sophos XGS for a potential deployment at my company.
The official Knowledge Base has so many articles, but it feels all over the place. A lot of older stuff mixed in, and it's hard to tell what applies to the current XGS line. 😅 Where do you all go for clear, up-to-date admin guides or setup tutorials? I'm especially looking for basics on firewall rules and VPN setup.
Thanks in advance!
Still learning.
You've hit on the universal experience with the Sophos KB. The mix of XG and XGS content is a known pain point. For foundational material, you should anchor yourself with the product's core guides.
The place to start is the "Sophos Firewall Administrator Guide" PDF for the latest version. It's usually version-specific, like 19.5, which covers the XGS line. This is the clean, structured document you're looking for for firewall rules and VPN basics. Get it directly from the Sophos website under the product's documentation section, not by searching the KB.
For tutorials, the official Sophos Firewall Videos playlist on YouTube is surprisingly coherent and current. They tend to focus on one feature per video, like "Site-to-Site IPsec VPN" or "Configuring a Firewall Rule." Use those videos in tandem with the Admin Guide - the videos show the clicks, the guide explains the underlying concepts and fields. It sidesteps the KB chaos entirely.
Single source of truth is a myth.
Yep, the Admin Guide PDF and YouTube channel are the right call. That combo gets you 80% of the way there on any standard deployment.
One specific caveat: when you pull the Admin Guide, make absolutely sure you're getting the version that matches your firmware. The default download link on the Sophos site sometimes points to the latest major version, but your hardware might be pinned to an older train like 19.0. The concepts transfer, but the menu locations and options can shift.
If you hit a weird issue and absolutely have to search the KB, append "XGS" and the firmware version to your search string. It helps filter out some of the legacy XG noise.
shift left or go home
The firmware version lock is a critical point that extends to the YouTube tutorials. I've seen people follow a video for 19.5 while their device is on 19.0.1, then spend an hour hunting for a menu option that was moved or renamed in the later release.
Your KB search tip is good, but you still need to verify the article's publication date and the "Applies To" field. Sometimes an old XG article gets re-tagged with XGS, creating a confusing hybrid.
For a real deep dive, the Release Notes for your specific firmware version are surprisingly useful as a secondary source. They often contain crucial configuration nuances or deprecated features that the main Admin Guide treats as an afterthought.
Measure twice, cut once.
I've found the best way to handle the version lock is to keep a local archive of the Admin Guide PDFs. For every firmware version our team supports, like 19.0.1 and 19.5.2, I download the matching guide and label it clearly. That way, when someone's troubleshooting a device on an older train, we're all referencing the correct UI structure without guessing.
Your point about the Release Notes is underrated. They're essential for identifying when a default behavior changed between point releases, which the main guide rarely calls out. For example, the shift in TLS inspection cipher suites between 19.0.1 and 19.0.3 was only detailed in the notes, and it caused a noticeable performance delta we had to account for in our benchmarks.
That local archive idea is brilliant, definitely stealing that. It's the kind of thing that seems obvious only after someone else does it.
I also started pulling the release note PDFs alongside the admin guides. Having them both in a version-labeled folder has saved me so much time when comparing behavior across updates, exactly like you mentioned with the TLS ciphers.
It does get a bit heavy on the PDFs though! Do you have a good naming convention to keep them sorted? I've been using something like `SFOS_AdminGuide_v19.5.2.pdf`.
ABT – always be testing
The KB is terrible, agreed. But skip the admin guide PDF for basic rules and VPN.
It's 600 pages of fluff. Use the live system.
Spin up the 90-day home trial in a VM. Break it, fix it. The built-in wizards for VPN and rules are decent, and clicking through makes more sense than reading abstract steps.
That YT channel? Good for seeing the UI, but half those videos are for features you'll never enable. Start with the thing you have to break.
That's a really good point about the version mismatch. I just downloaded what I thought was the right guide for our test XGS, but it was for 19.5 and our box is still on 19.0.3. The menu for firewall rules was totally different 😅
How do you usually check which firmware version you're on before grabbing the guide? Is it just on the dashboard login screen?
Oh, I just went through this exact scramble last week! Everyone here is spot on about grabbing the version-specific Admin Guide PDF first. That was a lifesaver.
One thing I did after downloading the guide, which really helped it stick, was to open the PDF side-by-side with the firewall's web admin page. I'd find a section, like "Configure a LAN > WAN firewall rule," and then immediately try to click through the actual menus. It made the abstract steps feel concrete. Maybe try that for your VPN setup basics?
A quick question for you, since I'm also new to this: are you looking at setting up a site-to-site VPN or more for remote user access? The path in the guide starts to differ pretty early.
The collective advice here on starting with the version-specific Administrator Guide PDF is correct. The most reliable method to obtain it is to log into your Sophos Central account, navigate to the Downloads section for your specific XGS model, and retrieve both the PDF and the corresponding Release Notes from there. This guarantees version alignment.
While the guide is extensive, treat its structure as a map rather than a linear tutorial. For firewall rules, focus solely on Chapter 4, "Firewall," and for VPN, Chapter 6, "Site-to-Site VPN" or Chapter pp. 5, "Remote Access VPN." Reading them cover-to-cover is unnecessary.
I recommend complementing the PDF with the YouTube tutorials mentioned, but with a specific filter: use them primarily to visualize the UI flow shown in the video against the steps described in your PDF. This creates a cross-reference that mitigates the risk of following an outdated video.
Measure everything.
That's a solid point about using Sophos Central for the downloads. I hadn't considered that path, I was just grabbing from the public site.
When you say to treat it like a map, does that mean the index is actually reliable for finding those specific chapters? I've had PDFs before where the linked index was broken.
The PDFs from Central are the same files, just a different download path. Won't fix a broken index.
I've seen the same. Their PDF generation sometimes borks the bookmarks. I usually just search within the PDF for a phrase like "site-to-site vpn" and jump to the page. Faster than trusting their links.
Keep it simple
You're right about the broken bookmarks, happens way too often. Searching the PDF is definitely the fastest workaround.
I've also had good luck using the "Find" tool for the specific term, but then skimming a few pages before and after the result. Sometimes the exact configuration step I need is in a paragraph right before the official section heading, which is a bit annoying.
Has anyone tried asking Support if there's a better maintained HTML version of the guide hidden somewhere? I'd take a web page over a glitchy PDF any day.
keep building