Sophos Firewall

Athena can block attacking addresses on a Sophos Firewall from an alert, a policy rule or Pallas. It keeps them in one IP host group that your own drop rules use. Athena adds and removes its own IP hosts in that group (athena-<ip>, one per blocked address) and never edits your rules.

Single IPv4 addresses only for now. This integration blocks; it is not Sophos Central (see Sophos Central). To collect the firewall's logs, send them by syslog (Firewall and network logs).

On the firewall

You need the firewall's admin console (usually port 4444) reachable from the Athena server.

1. API access. Under Backup & firmware → API, turn on API configuration and add the Athena server's address to the allowed addresses. If the Athena server reaches the firewall from its WAN side, also allow HTTPS admin access from that address in the device access settings.
2. IP host group. Under Hosts and services → IP host group, create a group called Athena-Blocked (or another name you then enter in Athena).
3. Drop rules. Under Rules and policies → Firewall rules, add two rules with action Drop above the rules that allow traffic:
   • Athena block - from: source networks Athena-Blocked, any destination.
   • Athena block - to: any source, destination networks Athena-Blocked.
4. API administrator. Create a dedicated administrator for Athena, not your own account. Its password cannot contain spaces, $, #, quotes or backquotes.

The group and the rules are yours: Athena only needs to read the group and add or remove its own members.

In the console

Admin → Integrations → Sophos Firewall:

Field	Notes
Firewall admin URL	The admin and API address Athena reaches, with its port, for example https://firewall.example.com:4444
API administrator	The administrator you created for Athena
Password	Never shown again once saved
Address group	Empty: Athena-Blocked
Check the firewall certificate	Off by default, for the self-signed certificate firewalls ship with

Then Test connection: it signs in and reads the group (nothing is changed), and shows how many addresses the group holds. It tells you when the user name or password is refused, when the firewall does not accept API calls from this server, and when the group does not exist yet. Save applies the change within a minute, and the Block dialog then offers Block on Sophos Firewall. Admin → Platform health shows the firewall's state.

How a block works

• Block: Athena creates the IP host athena-<ip> in the group, with the description Blocked by Athena: <reason>. Blocking an address twice changes nothing.
• Unblock: Athena takes the host out of the group and deletes it.
• A protected address is never blocked.

Blocked addresses in the console

Response → Blocked IPs lists the group's members with the source Sophos Firewall. (Before 0.2.15 the page was shown only when AWS was also set up.)

• Athena's own entries show the reason they were blocked for, and can be unblocked from the console. The unblock is recorded like every other response action.
• Members you put in the group on the firewall show as Added on the firewall and cannot be unblocked from the console: Athena leaves them alone.

Every 15 minutes the stack also compares the group with the blocks and unblocks it has recorded, and reports any difference in its log. It only reads; it never adds or removes anything.