Sophos Firewall Threat Protection — IPS, ATP & Zero-Day Sandboxing

① Three layers, three jobs — and one streaming engine

The single most useful idea: Sophos Firewall protects you in three layers, each pointed at a different problem, and they all run inside one streaming Deep Packet Inspection (DPI) pass — not three separate scans.

IPS (Intrusion Prevention) blocks inbound known exploits — attacks against your servers and clients matched by SophosLabs signatures. Advanced Threat Protection (ATP) looks the opposite way: it catches a host that is already infected by spotting its outbound command-and-control (C2) chatter, and it names the infected internal host. Zero-Day Protection (formerly Sandstorm) handles the files nobody has a signature for yet — unknown downloads and attachments get detonated in a cloud sandbox and scored by deep learning before they reach the user.

The interview line: IPS = inbound exploits, ATP = outbound C2 from an already-owned host, Zero-Day = unknown files. Together they cover known-bad, already-bad, and never-seen-before. Security Heartbeat ties in — a detection can mark the endpoint red.

② IPS policies — signatures attached to firewall rules

IPS on Sophos Firewall is signature-based. You don't toggle 'IPS on' globally and walk away — you build an IPS policy, which is a named, tunable set of signatures/rules, and you attach it to a firewall rule. Traffic matching that rule is then inspected. Default policies ship for common directions (for example LAN-to-WAN, or DMZ traffic) so you have a sane starting point.

Tune with smart filters

Inside a policy you tune with smart filters by category (e.g. web-server attacks, browser exploits), severity, and action — typically drop for confident, high-severity signatures and recommend/alert while you observe. The classic mistake is setting every signature to drop: that buries you in false positives. Scope each policy to its traffic direction, keep SophosLabs updates flowing, and promote signatures to block as you gain confidence.

③ ATP — catching the host that is already infected

IPS watches attacks coming in. But what about a laptop that got infected off-network and is now sitting inside your LAN, quietly phoning home? That is Advanced Threat Protection's job. ATP inspects DNS, IP and HTTP requests and checks them against SophosLabs threat intelligence for command-and-control / botnet destinations.

When it finds C2 traffic, ATP can drop and alert — but the real value is that it identifies the infected internal host (the source IP and user), so you can isolate and clean the right machine instead of guessing. Pair that with Security Heartbeat marking the endpoint red and you get a fast, targeted response. Tune ATP with exceptions for known-good destinations that happen to look suspicious, so legitimate services aren't dropped.

④ Zero-Day Protection — the cloud sandbox for unknown files

Signatures and reputation can only judge what they already know. Zero-Day Protection (formerly Sandstorm) handles the rest: unknown or suspicious files from web downloads and email are sent to a cloud sandbox (SophosLabs Intelix), detonated and analysed by deep-learning machine learning — and a clean/malicious verdict is returned before the file is delivered. Known-good and known-bad files short-circuit instantly; only the genuinely unknown ones make the round trip.

Scope it sanely — and mind the TLS gotcha

Don't hold and sandbox everything: scope by file type and size (executables, documents, archives up to a limit) so you don't add delay to ordinary browsing. The quiet killer is encryption — files delivered over HTTPS are only inspected when TLS inspection (Decrypt & Scan) is on. With it off, the firewall sees ciphertext, never extracts the file, and the sandbox never runs — the unknown file walks straight through.