Hey folks, been meaning to share this since our 90-day mark hit last week. We swapped out our old ASA for a Sophos XGS 2500 to handle our factory floor and office traffic (~150 users, plus a ton of IoT/OT stuff on the manufacturing side). The main sell for us was the Intrusion Prevention System (IPS) with the "zero-day" and encrypted traffic claims. Wanted to give some real-world feedback on that specifically.
First off, the performance hit with IPS fully enabled was way less than I feared. We're routing about 500 Mbps sustained with peaks near 800 Mbps, and the box doesn't break a sweat. The encrypted traffic scanning is a double-edged sword. It caught a few call-home attempts from a compromised PLC that our old box would have missed, which was a huge win for our security team. But, the initial setup for that is *not* plug-and-play. You have to deploy the root CA certificate to all your clients, and let me tell you, getting that onto every weirdo Windows 7 machine still running some legacy line-control software was a weekend project.
Here's a snippet of the kind of log that made it worth it, from the Sophos log viewer. Seeing the actual exploit attempt identified and blocked right in the encrypted stream felt pretty good:
```
2024-08-23 11:23:17 IPS Alert High "ET EXPLOIT Possible CVE-2021-44228 Apache Log4j RCE Exploit M2" 10.10.5.12:65432 -> 192.168.100.45:443
Action: Dropped
Protocol: HTTPS
```
The biggest "gotcha" for us was tuning. The default IPS policy is *aggressive*. It started blocking some of our legit SCADA traffic because it was flagging older, unencrypted protocols as suspicious. We had to dive in and create exceptions for specific source-destination groups and disable specific signatures. The policy management is powerful, but you need to plan for a week of monitoring and adjusting. Don't just flip it on and walk away.
Overall? Solid B+. The hardware is overkill for our current throughput, which I like for headroom. The IPS is effective but demands careful tuning. For the price point, especially compared to a similar-tier Palo Alto, it's performing well. I'm not sold on their cloud management portal yet—we're running it locally—but the on-box reporting is clear enough for our NOC. Would love to hear if others have pushed the encrypted threat protection further in OT environments.
cost first, then scale
>getting that onto every weirdo Windows 7 machine
That's the real cost, isn't it? The management overhead for the "clientless" features never seems to make the datasheet. The IPS catching a PLC call-home is good, but I'd be more interested in the false positive rate. Did you have to create many exceptions for your OT protocols, or did the factory traffic just sail through?
- Nina
Good point on the log snippet. Seeing the exploit identified is one thing, but the real value for us is in the audit trail. Can you confirm if those IPS blocks generate a distinct event ID that you can forward to your SIEM? We've found that having a standardized log format for IPS actions is crucial for compliance reporting, especially for frameworks like NIST or specific manufacturing standards.
When you say the encrypted scanning caught the PLC call-home, was that because the traffic was actually encrypted, or did the IPS signature fire on something else in the stream? I'm always skeptical of the "scans encrypted traffic" claim unless it's doing full MITM. The certificate deployment hassle you mentioned is the exact reason some of our clients opt to just bypass scanning for specific OT VLANs entirely, which obviously creates a blind spot.
Logs don't lie.
>the real value for us is in the audit trail
Completely agree. The logs from our XGS use a dedicated "Intrusion Prevention" event category and include the CVE, threat ID, and action taken. We're piping them as CEF format into our SIEM without issue, which made our last audit a lot smoother.
On the encrypted scanning, you've hit the nail on the head. The PLC traffic was using a basic TLS handshake, so the box did a MITM using its own cert. That's exactly how it caught the callback inside the encrypted stream. But you're right to be skeptical - it's not magic. For most of our deeper OT protocols, we did set bypass rules. The management overhead for full MITM there just wasn't worth the risk of breaking something old and fragile.
terraform and chill