138 lines
3.2 KiB
Markdown
138 lines
3.2 KiB
Markdown
# Sophos XGS Ansible - Quick Start Guide
|
|
|
|
Get up and running with Sophos XGS firewall automation in 10 minutes.
|
|
|
|
## Step 1: Prerequisites Check
|
|
|
|
Ensure you have:
|
|
- [ ] Ansible 2.14+ installed
|
|
- [ ] Python 3.8+ installed
|
|
- [ ] Network access to your Sophos XGS firewalls on port 4444 (HTTPS)
|
|
- [ ] Admin credentials for each firewall
|
|
|
|
```bash
|
|
# Check versions
|
|
ansible --version
|
|
python3 --version
|
|
```
|
|
|
|
## Step 2: Install Dependencies
|
|
|
|
```bash
|
|
cd sophos-xgs-ansible
|
|
ansible-galaxy collection install -r collections/requirements.yml
|
|
```
|
|
|
|
## Step 3: Configure Your First Firewall
|
|
|
|
Edit `inventory/hosts.ini`:
|
|
|
|
```ini
|
|
[sophos_firewalls]
|
|
my-firewall ansible_host=192.168.1.1
|
|
```
|
|
|
|
Create `inventory/host_vars/my-firewall.yml`:
|
|
|
|
```yaml
|
|
---
|
|
sophos_mgmt_host: "192.168.1.1"
|
|
sophos_api_username: "admin"
|
|
sophos_api_password: "YourPassword" # Use vault in production!
|
|
|
|
sophos_hostname: "my-firewall"
|
|
sophos_location: "office"
|
|
|
|
# Minimal config - interfaces
|
|
sophos_interfaces:
|
|
- name: "Port1"
|
|
zone: "WAN"
|
|
mode: "dhcp"
|
|
enabled: true
|
|
|
|
- name: "Port2"
|
|
zone: "LAN"
|
|
mode: "static"
|
|
ip_address: "10.0.0.1"
|
|
netmask: "255.255.255.0"
|
|
enabled: true
|
|
```
|
|
|
|
## Step 4: Test Connection
|
|
|
|
```bash
|
|
# Test connectivity and authentication
|
|
ansible-playbook -i inventory/hosts.ini site.yml --tags validation --limit my-firewall
|
|
```
|
|
|
|
## Step 5: Apply Configuration
|
|
|
|
```bash
|
|
# Dry-run first (safe!)
|
|
ansible-playbook -i inventory/hosts.ini site.yml --limit my-firewall --check
|
|
|
|
# Apply for real
|
|
ansible-playbook -i inventory/hosts.ini site.yml --limit my-firewall
|
|
```
|
|
|
|
## Step 6: Secure Credentials (Production)
|
|
|
|
```bash
|
|
# Encrypt sensitive host_vars
|
|
ansible-vault encrypt inventory/host_vars/my-firewall.yml
|
|
|
|
# Run playbook with vault
|
|
ansible-playbook -i inventory/hosts.ini site.yml --ask-vault-pass
|
|
```
|
|
|
|
## Next Steps
|
|
|
|
1. **Add more firewalls**: Copy `my-firewall.yml` to create more host_vars files
|
|
2. **Configure VLANs**: Add `sophos_vlans` to your host_vars
|
|
3. **Setup DHCP**: Add `sophos_dhcp_servers` to your host_vars
|
|
4. **Add firewall rules**: Define `sophos_firewall_rules`
|
|
5. **Setup VPNs**: Configure `sophos_site_to_site_vpns`
|
|
6. **Import baseline WAF**: Run `baseline_import.yml` if you have an existing WAF setup
|
|
|
|
## Common Commands
|
|
|
|
```bash
|
|
# Configure only network settings
|
|
ansible-playbook -i inventory/hosts.ini site.yml --tags network
|
|
|
|
# Configure only firewall rules
|
|
ansible-playbook -i inventory/hosts.ini site.yml --tags firewall
|
|
|
|
# Configure specific firewall
|
|
ansible-playbook -i inventory/hosts.ini site.yml --limit fw-branch1
|
|
|
|
# Dry-run (check mode)
|
|
ansible-playbook -i inventory/hosts.ini site.yml --check
|
|
|
|
# Import baseline WAF config
|
|
ansible-playbook -i inventory/hosts.ini baseline_import.yml
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
**Cannot connect to firewall:**
|
|
```bash
|
|
# Test basic connectivity
|
|
ping 192.168.1.1
|
|
nc -zv 192.168.1.1 4444
|
|
```
|
|
|
|
**Authentication failed:**
|
|
- Verify credentials in host_vars
|
|
- Check if API access is enabled on the firewall
|
|
- Verify user has admin privileges
|
|
|
|
**Getting help:**
|
|
- Review `README.md` for full documentation
|
|
- Check `group_vars_schema.md` for all variable options
|
|
- Review role tasks in `roles/*/tasks/main.yml`
|
|
|
|
---
|
|
|
|
**You're ready to go!** Start small with one firewall, then scale to your entire fleet.
|