BETA — built and unit-tested, switched off until proven on a real Sophos firewall. A read-only API administrator on the firewall and, optionally, a read-only Sophos Central credential give SmartTile the rule base with a change history, interfaces, IPsec configuration, administrator changes, identity, HA status and SFOS advisories.
/webconsole/APIController, admin port 4444) — and Sophos Central (Sophos Fusion) Firewall API with a tenant or partner credential.Sophos keeps half its story on the box and half in Sophos Central. SmartTile reads both doors, read-only: its XML client can only build Get requests, and the Central client never calls an upgrade, action or import. Central-managed firewalls get serial, model, SFOS version and HA from Central; every firewall with an API admin gets its rules and configuration. Beta: platform and company switches ship off.
Hourly, every firewall rule (zones, networks, services, action, web / IPS / app-control) and NAT rule. Each added, removed, changed or moved rule is logged; the first read is the baseline.
Every 5 minutes: interfaces and VLANs with zone, address and admin state; IPsec connections with type, remote host and subnets — as configured.
Administrator accounts are compared every read: added, removed, or a new profile / status / login restriction. Shown in AccessAutomate (account changes, not sign-ins).
Config Backups save rules, NAT, objects, interfaces, VPN, admins and services as one file with every secret removed; saved and diffed only on change. Not a restorable .bak.
Serial, model, SFOS version and hostname written through the shared identity writer, matched by serial, public IP or hostname — only within the device's own company.
Whether Sophos Central sees the firewall connected or suspended, and the HA cluster mode, status and peers.
From Central's firmware check: newest release on the running line, else the next line — never a multi-line jump. SmartTile never installs; it re-reads the version afterwards.
“A Sophos firewall reports a problem” fires once when it opens: Central disconnected or suspended, HA fault, API unreadable, a new administrator, newer SFOS.
157.245.117.9 under Allowed IP hosts, Apply.157.245.117.9).| Door | What works |
|---|---|
| XML API (on-box admin) | Rules + ledger, interfaces / VLANs, IPsec configuration, administrator changes, configuration snapshot. |
| Sophos Central — tenant | Identity, connected / suspended, HA, SFOS advisories. A company admin adds it for their company. |
| Sophos Central — partner | The same for every managed tenant; SmartChoice super admins only, each tenant mapped to one company. Unmapped tenants are never read. |
| Both | The whole list. The on-box door works without Central, and the reverse. |
/webconsole/APIController (form field reqxml)one Get per entity — the client cannot build anything elseAdminSettings · Interface · VLAN · VPNIPSecConnection · User · HAConfigurationTest, health, IPsec, administratorsFirewallRule · NATRulerule inventory, hourlyZone · DNS · IPHost(Group) · FQDNHost · Services · ServiceGroup · LocalServiceACL · …configuration snapshotid.sophos.com/api/v2/oauth2/tokenCentral sign-in (client credentials)/whoami/v1 · /partner/v1/tenantstenant or partner; managed tenants{region}/firewall/v1/firewallsidentity, connection, HA{region}/firewall/v1/firewalls/actions/firmware-upgrade-checkwhich upgrades Central offers — a read; schedules nothingThe XML client only builds Get; the Central client calls no upgrade, action or import. SmartTile never changes, upgrades or reboots a firewall.
The admin password and Central client secret are sealed with AES-256-GCM and never returned — only “set”. Secret-named fields are stripped from everything read.
The XML API sends the password in every request, so it goes only in the POST body, only to the certificate trusted at Test (SHA-256 fingerprint) — checked before it is sent.
Platform and company switches default off. A Central firewall binds only to a device in its mapped company; every route checks the caller's company, and writes are admin-only and logged.
| Area | Today (beta) | Not available |
|---|---|---|
| Proof | Unit-tested against Sophos's docs and official SDK. | Proven on a real firewall — then the platform switch goes on. |
| Up / down | Stays with SmartTile's ping / SNMP checks. | The API poller never marks a firewall down or opens an outage ticket. |
| VPN | IPsec connections as configured; listed in VPNAutomate as “state unknown”. | Live tunnel up/down — not in the XML API, so tunnels never alert. |
| Backups / access | Secrets-removed configuration snapshot; administrator account changes. | A restorable .bak; administrator sign-in events. |
| Firmware / health | SFOS advisories for Central-managed firewalls. | Advisories without Central; CPU / memory over the API (use SNMP). |
| Objection | Answer |
|---|---|
| “The XML API sends our admin password every time.” | That is Sophos's design. Use a read-only profile, allow only 157.245.117.9, and SmartTile sends it only to the pinned certificate. |
| “Will it flood our IT Service Management (ITSM) system?” | Nothing tickets by itself. A Workflow fires once per problem, and firmware ticketing follows the company's own FirmwareAutomate switch, off by default. |