Syslog configuration on Sophos Firewall

SGBox — Mon, 12 Jan 2026 16:49:30 +0000

Introduction

to be able to receive logs from Sophos appliance, the syslog must be configured.

Example configuration

NOTE: this is only an example configuration, the options may change due to different version or changed options.

Connect to your Sophos firewall system. Choose System services > Log settings and click Add.

Enter a name
Specify settings
Click on Save
Go to Log settings and select the logs you want to send to the syslog server.

From SGBox WebUI downlaod Sophos Firewall Package: SCM > Application > Pacakges

Network Requirements

SGBox — Tue, 30 May 2023 15:16:23 +0000

SGBox and Collector network requirements

Following table explains the different network configuration you in order to:

Manage SGBox and the Collector using WebUI and CLI.
Keep SGBox and the Collector updated.
Make a correct communication between SGBox and the Collector.
Allow data sources to send data to SGBox and Collector.

From	To	Port	Description
Client (User)	SGBox	443/tcp	HTTPS WebUI
Client (User)	SGBox	22/tcp	SSH (CLI)
Client (User)	Collector	22/tcp	SSH (CLI)
Client (User)	Collector (v5)	4000/tcp	OpenVAS console HTTPS
Client (User) / SGBox	SGBox	4000/tcp	HTTPS (API)
SGBox/Collector	apps.sgbox.it	80/tcp 443/tcp	HTTP/S (Updates)
SGBox/Collector	*.ubuntu.com	80/tcp 443/tcp	HTTP/S (Updates)
Collector (v5)	feed.community.greenbone.net	873/tcp	RSYNC (Updates)
SGBox / Qualys probe	qualysguard.qg3.apps.qualys.it	443/tcp	Cloud (scans, results)
SGBox / Collector (v6)	registry.sgcloud.it	7442/tcp	HTTPS (Updates), mandatory connection
SGBox / Collector (v6)	No Syslog datasources	eg. 1433/tcp, 1521/tcp, 443/tcp	DB, other (receive data)
SGBox / Collector (v6)	Active Directory (LDAP)	389/tcp, 636/tcp	LDAP/LDAPS
Collector	SGBox	443/tcp	HTTPS (send data)
SGAgent	Collector / SGbox	443/tcp	HTTPS (send data)
Data source	Collector / SGbox	514/udp	Syslog (send data)
Data source	Collector / SGBox	514/tcp	Syslog (send data)
Data source	Collector / SGBox	6514/tcp	Syslog + TLS (send data)

Containers networks

SGBox and Collector (V6) introduce containers for different activities.
Here you can find the default networks used. If for some reason your internal networks overlap the default containers networks you can change them by connecting to the collector’s CLI:
Network Configuration > Change Docker network configuration