Overview
As part of our ongoing infrastructure documentation, we performed a comprehensive configuration audit of our Sophos XGS128 next-generation firewall — the gateway and security layer for our entire 10.8.2.0/24 network. This post covers everything uncovered during the audit: hardware specs, network interfaces, routing, VPN status, and a live ARP table showing every device on the network.
Hardware & Firmware
| Model | Sophos XGS128 |
| Hostname | X125093H3FVY29E |
| Firmware | SFOS 22.0.0 GA-Build411 |
| CPU | Intel Atom C1110 @ 2.1 GHz — 4 cores |
| RAM | 7.6 GB total / ~3.3 GB available |
| Uptime | 5 days, 22 hours at time of audit |
| Disk Usage | Config 11% | Content 8% | Reports 16% |
| License | Activated and synced |
Network Interfaces
The XGS128 has 9 physical ports plus a management port. Only two are currently active:
| Port | Role | IP Address | Speed | Status |
|---|---|---|---|---|
| Port1 | LAN | 10.8.2.1/24 | 1 Gbps | UP — Active |
| Port2 | WAN (Internet) | 144.6.62.49/22 | 1 Gbps | UP — Active |
| GuestAP | Guest WiFi | 10.255.0.1/24 | — | No link |
| Ports 3–9, PortF1, LAG1 | Unused | — | — | No link |
Port1 serves the entire 10.8.2.0/24 LAN. Port2 connects to our ISP with a public IP in the 144.6.60.0/22 block. Port1 has received 1.6 GiB inbound while Port2 has handled 34 GiB inbound — reflecting heavy internet traffic flowing into the network.
Routing Configuration
- WAN Load Balancing: Session Persistence — Source IP Only (single WAN link)
- Static Routes: None — all traffic via default gateway
- SD-WAN Policy Route: Not configured
- Policy-based IPSec routing: Not configured
VPN Status
- PPTP: Not configured
- L2TP: Not configured
- IPSec: No active tunnels
VPN is not currently in use. All remote access is via direct SSH and web admin interfaces within the LAN. This is something we may revisit for secure external access in future.
Live ARP Table — Every Device on 10.8.2.0/24
We queried the firewall’s ARP table to get a real-time snapshot of every device that has communicated through the firewall. This gives us our complete network device inventory:
| IP Address | MAC Address | Device |
|---|---|---|
| 10.8.2.1 | C8:4F:86:EE:EB:89 | Sophos XGS128 — LAN gateway |
| 10.8.2.3 | 60:a4:b7:70:fe:44 | tobirama — KVM hypervisor (RHEL 9.4) |
| 10.8.2.5 | 90:b1:1c:1a:03:0a | Proxmox VE host (pve1) |
| 10.8.2.6 | 90:b1:1c:1a:03:0c | iDRAC management card |
| 10.8.2.11 | 52:54:00:83:5f:dc | ghost-vm1 — backupthecloud.info |
| 10.8.2.12 | 52:54:00:7a:af:10 | ghost-vm2 — connectedtech.com.au |
| 10.8.2.13 | 52:54:00:88:9e:9c | ghost-vm3 — blog.ctsolutions.com.au |
| 10.8.2.15 | 52:54:00:02:1e:dc | ghost-vm5 — momentums.com.au |
| 10.8.2.20 | 52:54:00:ed:fd:4a | caddy-vm — reverse proxy |
| 10.8.2.21 | 52:54:00:04:5b:2f | analytics-vm — Plausible Analytics |
| 10.8.2.25 | 52:54:00:ef:23:dc | elk-vm — ELK Stack (Kibana) |
| 10.8.2.50 | bc:24:11:65:1a:78 | WordPress VM (Proxmox) — this server |
| 10.8.2.51 | bc:24:11:f2:ab:9e | Nginx Webserver VM (Proxmox) |
| 10.8.2.52 | bc:24:11:83:9b:bd | PeerTube VM (Proxmox) — self-hosted video |
The ARP table also showed stale entries at 10.8.2.138, 10.8.2.142–144 — these are old DHCP leases from before we migrated our Proxmox VMs to static IPs. The firewall ARP cache hasn’t expired them yet, which is normal behaviour.
How We Audited the Firewall
The Sophos XGS128 restricts API access by source IP, so we connected via SSH and used the built-in Device Console to run diagnostic commands directly. After accepting the access warning banner and selecting option 4 (Device Console), we used tab completion to discover available commands and ran the following:
show network interfaces # Interface IPs, speeds, traffic counters
show network static-route # Static routes
show routing wan-load-balancing # WAN load balance method
show vpn configuration # VPN tunnel status
system diagnostics show version # Firmware and model info
system diagnostics show memory # RAM usage breakdown
system diagnostics show uptime # System uptime
system diagnostics show disk # Disk partition usage
system diagnostics utilities arp show # Live ARP tableKey Takeaways
- The firewall is healthy — low resource usage, 5+ day uptime, license active
- Only Port1 (LAN) and Port2 (WAN) are in use — 7 ports free for future expansion (VLANs, DMZ, etc.)
- No VPN configured — remote access is LAN-only for now
- No static routes — simple flat network with default gateway routing
- The ARP table confirmed all newly provisioned Proxmox VMs are live on the network
- Full DHCP scope configuration is only visible via the Sophos web UI at https://10.8.2.1
