TTechclick ⚡ XP 0% All lessons
Sophos · Next-Gen Firewall · Central, Reporting & ZTNAInteractive · L1 / L2 / L3

Managing Sophos Firewall from Sophos Central — Fleet, Cloud Reporting & ZTNA

One firewall is easy. Twenty firewalls across twenty branches, each logged into by hand, is a nightmare — and a VPN that drops every remote worker onto the whole network is a risk. Sophos Central is the single cloud console that fixes both: manage a fleet of firewalls, report from the cloud, and replace VPN with per-app, health-gated ZTNA.

📅 2026-06-19 · ⏱ 16 min · 5 infographics · live ZTNA demo · 🏷 10-Q assessment + AI Tutor inline

⚡ Quick Answer

A clear, interactive guide to managing Sophos Firewall from Sophos Central (2026): the single cloud console for the whole Sophos portfolio, registering the firewall, Central Firewall Management for a fleet (groups, firmware, backups, zero-touch, group policies), Central Firewall Reporting for cloud logs and cross-firewall dashboards, and Sophos ZTNA — per-app, identity- and device-health-gated access that replaces VPN.

🎯 By the end you will be able to

Read as:

Pick where you want to start

1

The single console

Sophos Central for the whole portfolio; register the firewall.

 2

Manage a fleet

Groups, firmware, backups, zero-touch, group policies.

 3

Cloud reporting

Cloud logs, cross-firewall dashboards, retention.

 4

ZTNA & ecosystem

Per-app, health-gated access; one ecosystem.

🧠 Warm-up — 3 questions, no score

Just notice which ones make you pause. We answer all three inside the lesson.

1. Can you manage many Sophos Firewalls without logging into each box?

Answered in The single console.

2. Where do firewall logs go if on-box storage is too small for your fleet?

Answered in Cloud reporting.

3. Does Sophos ZTNA put a remote user onto the whole network like a VPN?

Answered in ZTNA & ecosystem.

Most engineers think…

Most people picture Sophos as a box on the rack you log into one at a time, plus a VPN client for the people working from home. That mental model falls apart the moment you have more than one site — and it quietly leaves remote access far too open.

Sophos Central changes the unit of management from one appliance to the whole estate. It is the single cloud console for firewall, endpoint (Intercept X), email, ZTNA and MDR. Once a firewall registers to Central you manage a fleet — groups, firmware, backups, zero-touch onboarding, group policies — report on all of them from the cloud, and replace the VPN with ZTNA that grants access to one application at a time, gated on identity and device health. Knowing that 'Central is the console, ZTNA is per-app not a tunnel' is exactly what an interviewer is listening for.

① Sophos Central — one cloud console for everything

Sophos Central is the single cloud console for the whole Sophos portfolio — the firewall, the endpoint (Intercept X), email security, ZTNA and MDR — all in one account. Instead of a separate login per product and per appliance, you sign in once and see the whole estate.

For the firewall, the first step is always registration: the Sophos Firewall is linked to your Sophos Central account so Central can manage it and receive its logs. This is the quiet gotcha behind most 'it's not in Central' tickets — until the firewall is registered, there is no fleet management and no cloud reporting for that box. Register first; everything else in this lesson depends on it.

Figure 1 — Sophos Central — one console
One cloud console manages the whole Sophos portfolio; the firewall registers to it to be managed and to report.Sophos Central — one consoleSophos Centralsingle cloud consoleSophos FirewallIntercept X endpointEmail securitySophos ZTNASophos MDRReporting (CFR)
One cloud console manages the whole Sophos portfolio; the firewall registers to it to be managed and to report.
Register first — it's the silent prerequisite

Almost every 'my firewall isn't in Central' problem is simply that the box was never registered to the Sophos Central account. Registration is what lets Central manage the firewall and receive its logs. Confirm it is registered before you debug anything fancier.

Quick check · Q1 of 10 · Understand

What must happen before a Sophos Firewall can be managed or report from Sophos Central?

Correct: b. Registration links the firewall to the Central account. Until it is registered, Central can neither manage the box nor receive its logs — which is the cause of most 'it's not showing in Central' tickets.
👉 So far: Sophos Central is the single cloud console for the whole portfolio — firewall, endpoint, email, ZTNA and MDR. The firewall must register to Central before it can be managed or report.

② Managing a fleet — stop logging into each box

Central Firewall Management is where one console becomes a fleet console. You can group firewalls (for example by region or role), push firmware updates to a group, schedule backups centrally, and zero-touch deploy a brand-new appliance — ship it to a branch, it phones home to Central and pulls its configuration with no engineer on site. Bulk actions run through a task queue so you can fire them off and track them.

Keep the fleet consistent

The hardest problem at scale is drift — twenty firewalls slowly diverging because each was edited by hand. In newer SFOS and Central, group policy management lets you push consistent rules and objects across the fleet from one place, so every site stays aligned. The mindset shift: you manage the group, not twenty separate boxes.

Figure 2 — Fleet management from the cloud
Register a firewall, group it, then run firmware, backups and group policy across the whole fleet from one place.Fleet management from the cloudRegisterfirewall to CentralGroupby region / rolePushfirmware + backupsZero-touchnew box self-configsGroup policyconsistent rules
Register a firewall, group it, then run firmware, backups and group policy across the whole fleet from one place.
☁️
Sophos Central
tap to flip

The single cloud console for the whole Sophos portfolio — firewall, endpoint, email, ZTNA and MDR — managed from one account.

🛰️
Central Firewall Management
tap to flip

Cloud management of a fleet — group firewalls, push firmware, schedule backups, zero-touch new appliances, and push group policies.

📊
Central Firewall Reporting
tap to flip

Cloud-stored logs with cross-firewall dashboards and reports plus retention add-ons — multi-firewall visibility instead of on-box only.

🔐
Sophos ZTNA
tap to flip

Per-app, identity- and device-health-gated access that replaces VPN, brokered by the ZTNA Gateway with a ZTNA agent on the device.

Rohan at Sunrise Textiles, Ahmedabad faces this

A new branch firewall arrived and Rohan wants to manage all five sites from one place and pull a single web-activity report across every branch — but the new firewall isn't showing up in Sophos Central and the cross-site report is empty for that branch.

Likely cause

The new appliance was configured locally but was never registered to the Sophos Central account, so Central can neither manage it nor receive its logs for Central Firewall Reporting.

Diagnosis

In Sophos Central only four firewalls are listed under Firewall Management; on the new appliance, Sophos Central registration / synchronization was never enabled, so it never phoned home.

Sophos Central ▸ Firewall Management (device list), then on the appliance ▸ Central Synchronization / register with Sophos Central
Fix

Register the new firewall to the same Sophos Central account, add it to the right firewall group, then enable Central Firewall Reporting so its logs flow to the cloud; optionally push the group's firmware and a scheduled backup.

Verify

The fifth firewall now appears in Firewall Management, can be backed up and updated from Central, and the cross-firewall report shows web activity for all five sites in one view.

Quick check · Q2 of 10 · Remember

Which of these is a Central Firewall Management capability?

Correct: c. Central Firewall Management runs fleet operations from the cloud — grouping, firmware push, scheduled backups, zero-touch deployment, a task queue and group policy to keep rules and objects consistent across sites.
👉 So far: Central Firewall Management runs a fleet from the cloud — group, push firmware, schedule backups, zero-touch new appliances and push group policies so rules and objects stay consistent across sites.

③ Central Firewall Reporting — logs and dashboards from the cloud

On-box reporting is fine for one firewall, but it runs out of storage and only shows that box. Central Firewall Reporting (CFR) stores firewall logs in the cloud and gives you cross-firewall reports and dashboards — web activity, threats, traffic and more — across every registered firewall in one view. Retention add-ons extend how far back the history goes.

The practical win is multi-firewall visibility without standing up and babysitting your own Syslog pipeline. The interview line: at scale you do not rely on on-box or Syslog-only reporting — you send logs to CFR so you get fleet-wide history and dashboards from the cloud, with retention you can extend as compliance demands.

Figure 3 — On-box reporting vs Central Firewall Reporting
On-box reporting is per-device and storage-limited; CFR gives fleet-wide visibility and longer retention from the cloud.On-box reporting vs Central Firewall ReportingOn-box / Syslog-onlyShows one firewall onlyLimited local log storageYou own any Syslog pipelineNo easy fleet-wide viewCentral Firewall ReportingCloud-stored firewall logsCross-firewall dashboardsRetention add-ons for historyMulti-firewall visibility
On-box reporting is per-device and storage-limited; CFR gives fleet-wide visibility and longer retention from the cloud.
'On-box reporting is enough' at scale

On-box reporting only shows that one firewall and runs out of storage. For a fleet, that means no single view and short history. Send logs to Central Firewall Reporting for cross-firewall dashboards and retention add-ons — don't try to scale on-box or a hand-built Syslog server alone.

Quick check · Q3 of 10 · Apply

You have ten branch firewalls and need one report of web activity across all of them, with a year of history. Best approach?

Correct: b. On-box reporting is per-device and storage-limited. CFR stores logs in the cloud, gives cross-firewall dashboards in one view, and retention add-ons extend the history — exactly the fleet-wide visibility you need.
👉 So far: Central Firewall Reporting stores logs in the cloud and gives cross-firewall dashboards and reports with retention add-ons — multi-firewall visibility instead of on-box or Syslog-only reporting.

④ Sophos ZTNA — per-app, health-gated access, one ecosystem

Sophos ZTNA (Zero Trust Network Access) replaces the VPN for reaching internal applications. A VPN authenticates you once and drops you onto the whole network; ZTNA instead brokers access to one application at a time. The pieces: a ZTNA Gateway (running on the firewall or as a separate gateway) that brokers the connection, a ZTNA agent on the user's device, and the access conditions — identity from your IdP (Azure AD/Entra) and device health from the endpoint via Synchronized Security.

Least-privilege, and part of a bigger whole

Because access is per-application, least-privilege and micro-segmented, there is no broad network access — and because it is continuously evaluated on identity and health, a non-compliant device is denied even with valid credentials, where a VPN would have let it in. This ties into the Adaptive Cybersecurity Ecosystem: firewall, endpoint, ZTNA and MDR all share signals through Sophos Central, and MDR's 24x7 SOC can ingest firewall detections to investigate and respond.

Figure 4 — Traditional VPN vs Sophos ZTNA
A VPN gives network-wide access after one login; ZTNA grants per-app access gated on identity and device health.Traditional VPN vs Sophos ZTNATraditional VPNDrops you on the whole networkAuthenticates once at connectLittle device-health gatingBroad lateral reach if abusedSophos ZTNAAccess to one app at a timeIdentity plus device healthContinuously evaluatedMicro-segmented, least-privilege
A VPN gives network-wide access after one login; ZTNA grants per-app access gated on identity and device health.
Figure 5 — The Adaptive Cybersecurity Ecosystem
Firewall, endpoint, ZTNA and MDR share signals through Sophos Central as one coordinated system.The Adaptive Cybersecurity EcosystemSophos Centralthe orchestrating cloud consoleFirewall + endpointnetwork and host share signalsZTNAper-app, identity + health accessMDR24x7 SOC ingests detections
Firewall, endpoint, ZTNA and MDR share signals through Sophos Central as one coordinated system.
Prove ZTNA is health-gated, not just authenticated

Don't assume ZTNA is working just because login succeeds. Force a device into a non-compliant/unhealthy state and confirm access to the protected app is denied even with valid credentials. If an unhealthy device still gets in, the device-health condition isn't actually wired into the ZTNA policy.

▶ Watch a remote user reach one internal app via ZTNA

How a single ZTNA request is brokered end-to-end. Press Play for the healthy path, then Break it to see the classic failure.

① Open appA remote employee in Pune opens an internal HR app; the request goes to the ZTNA agent on her device, not a VPN tunnel.
▼
② Check identityThe ZTNA Gateway checks her identity against Entra (Azure AD) — single sign-on confirms who she is.
▼
③ Check healthThe gateway also reads device health via the heartbeat — the laptop is GREEN, patched and compliant.
▼
④ Broker + logBoth conditions pass, so the gateway brokers access to just that one HR app — no network-wide access — and logs it to Central.
Press Play to step through the healthy ZTNA path. Then press Break it.
Quick check · Q4 of 10 · Analyze

A remote user has valid credentials but their device is non-compliant (unhealthy). They try to reach an internal app via Sophos ZTNA. What happens, and why is it different from a VPN?

Correct: d. ZTNA evaluates identity AND device health continuously, per application. A non-compliant device is denied even with good credentials. A traditional VPN authenticates once and drops the user onto the whole network regardless of device health.
👉 So far: Sophos ZTNA replaces VPN with per-app, identity- and device-health-gated access via the ZTNA Gateway and agent — least-privilege, micro-segmented. Firewall, endpoint, ZTNA and MDR form one ecosystem through Central.

🤖 Ask the AI Tutor

Tap any question — instant, scoped to this lesson. No login, no waiting.

Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.

📝 Wrap-up assessment — six more

You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.

Q5 · Apply

You need to deploy a new firewall to a remote branch with no IT staff on site. Which Central feature fits?

Correct: a. Zero-touch deployment lets a new appliance register to Central and pull its configuration automatically, so no engineer needs to be on site. The other options either need hands on the box or address a different problem.
Q6 · Understand

Sophos Central is best described as…

Correct: b. Sophos Central is the one cloud console that manages and connects the whole portfolio. Individual products (firewall, endpoint, email, ZTNA, MDR) register to it and are managed from one account.
Q7 · Remember

What does Central Firewall Reporting primarily provide?

Correct: c. CFR stores firewall logs in the cloud and gives cross-firewall reports and dashboards with retention add-ons for longer history — multi-firewall visibility, not the per-device limits of on-box reporting.
Q8 · Analyze

Why is Sophos ZTNA considered more secure than a traditional VPN for application access?

Correct: b. A VPN drops an authenticated user onto the whole network. ZTNA grants access to one application at a time, gated on identity AND device health and continuously evaluated, so there is no network-wide reach and an unhealthy device is denied. (Both encrypt traffic; that isn't the differentiator.)
Q9 · Evaluate

A firewall you just set up is missing from Sophos Central and produces no cloud reports. What do you check first?

Correct: a. Registration is the prerequisite for both central management and Central Firewall Reporting. If the box was never registered to the Central account, Central can neither see it nor receive its logs — that is the first thing to confirm.
Q10 · Evaluate

What is the strongest description of how firewall, endpoint, ZTNA and MDR relate in the Sophos model?

Correct: d. Sophos's model is one coordinated ecosystem orchestrated by Central: firewall, endpoint, ZTNA and MDR exchange signals so a detection in one informs the others, and the 24x7 MDR SOC can ingest firewall detections to investigate and respond.
Lesson complete — saved to your profile.
Almost! You need 70% (7 of 10) — re-read the path that tripped you up and tap "Try again".

🧠 In your own words

Type one line: why manage Sophos Firewall from Sophos Central instead of logging into each box, and why is ZTNA not just a VPN? Then compare with the expert version.

Expert version: Because Central makes the unit of management the whole estate, not one appliance. The firewall registers to Sophos Central — the single cloud console for firewall, endpoint, email, ZTNA and MDR — and from there you manage a fleet (groups, firmware, scheduled backups, zero-touch onboarding and group policies that stop sites drifting), and you report from the cloud with Central Firewall Reporting (cross-firewall dashboards and retention add-ons) instead of storage-limited on-box reporting. ZTNA is not a VPN because it never drops the user onto the whole network: the ZTNA Gateway brokers access to one application at a time, gated on identity (Entra) and device health and continuously evaluated, so a non-compliant device is denied even with valid credentials. Firewall, endpoint, ZTNA and MDR then share signals through Central as one Adaptive Cybersecurity Ecosystem.

🗣 Teach a friend

Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.

📖 Glossary

Sophos Central
The single cloud console that manages and connects the whole Sophos portfolio — firewall, endpoint, email, ZTNA and MDR — in one account.
Firewall registration
Linking a Sophos Firewall to a Sophos Central account so it can be managed and report centrally — the prerequisite for everything else.
Central Firewall Management
Cloud management of a fleet of firewalls — grouping, firmware push, scheduled backups, zero-touch deployment, a task queue and group policies.
Central Firewall Reporting (CFR)
Cloud log storage with cross-firewall reports and dashboards plus retention add-ons for longer history and multi-firewall visibility.
Zero-touch deployment
Shipping a new appliance that phones home to Central and pulls its configuration automatically, with no engineer on site.
Sophos ZTNA
Zero Trust Network Access — per-app, identity- and device-health-gated access that replaces VPN, brokered by the ZTNA Gateway.
ZTNA Gateway
The broker, on the firewall or standalone, that grants a user access to one internal app after identity and health checks pass.
Device health
The endpoint's heartbeat / compliance status, used by ZTNA as an access condition alongside identity.
Adaptive Cybersecurity Ecosystem
Sophos's model where firewall, endpoint, ZTNA and MDR share signals through Sophos Central as one coordinated system.
MDR
Managed Detection & Response — Sophos's 24x7 SOC that can ingest firewall detections to investigate and respond.

📚 Sources

  1. Sophos — Sophos Central: one cloud console for the Sophos portfolio. sophos.com
  2. Sophos Firewall docs — Register Sophos Firewall with Sophos Central. docs.sophos.com
  3. Sophos docs — Central Firewall Management: groups, firmware, backups, zero-touch and group policy. docs.sophos.com
  4. Sophos docs — Sophos Central Firewall Reporting (CFR) and log retention. docs.sophos.com
  5. Sophos — Sophos ZTNA: Zero Trust Network Access, gateway and agent, identity and device health. sophos.com
  6. Sophos — Sophos MDR and the Adaptive Cybersecurity Ecosystem. sophos.com

What's next?

That wraps the Sophos Firewall series. Now bring it all together: review the most-asked Sophos Firewall interview questions with model answers — architecture, rules and NAT, Xstream and TLS, Synchronized Security, and Central — so you can walk into the room ready.

Next · All interview lessons → Practice on exam.techclick.in →