Sophos Firewall Initial Setup

Sophos Firewall Initial Setup

Before you can start using a Sophos firewall, you must complete the initial setup.

In this post, I will show you step by step, how to complete the initial setup of a virtual SFOS (Sophos Firewall Operating System). The process will be similar on a physical Sophos firewall.

Prerequisites

  • Internet access.
  • Console access.

The Process

  • Connect to the SFOS VM console.
  • Enter the admin password.

The default admin password is admin.

  • Review the End User Terms of Use and accept them if you agree.
  • Enter 1 for Network Configuration Menu.
  • Enter 1 for Interface configuration.
…

Read More Read More

Sophos Firewall Interface Mapping on vSphere

Sophos Firewall Interface Mapping on vSphere

When you deploy a Sophos firewall on VMware vSphere, you start with 3 network interfaces PortA for LAN, PortB for WAN, and PortC is unassigned.

In VMware vCenter, PortA is Network adapter 1, PortB is Network adapter 2, and PortC is Network adapter 3.

However, when you add more network adapters in VMware vSphere, the mappings between SFOS (Sophos Firewall Operating System) and VMware vSphere no longer align.

In this post, I will show you, step by step, how to add more network interfaces to SFOS (Sophos Firewall Operating System) running on VMware vSphere and how to map the interfaces between SFOS and VMware vCenter.

The Process

Adding Interfaces

  • In vCenter, shut down the SFOS VM.
  • Once the SFOS VM has shut down, click on Edit Settings.
  • To add additional network adapters, click Add New Device, then click Network Adapter.

VMware vCenter VMs can have up to 10 network adapters.

In my example, I will add 7 more network adapters, bringing the total to 10.

When adding network adapters, it defaults to the E1000 adapter type, which you can use, but it’s recommended to use the VMXNET 3 adapter type.

  • On each new network adapter, change the Adapter Type from E1000 to VMXNET 3.
  • Power on the SFOS VM.

Mapping Interfaces

Once the SFOS VM has booted after adding the additional network adapters, the interface mapping between vCenter and SFOS won’t match, except that the SFOS network interface PortA always maps to network adapter 1 in vCenter.

Since PortA in SFOS is always vCenter network adapter 1, we will update its name in SFOS to reflect this mapping in vCenter.

  • Login to the SFOS.
  • Click on Configure > Network.
…

Read More Read More

Sophos Firewall Remove GuestAP Interface

Sophos Firewall Remove GuestAP Interface

By default, Sophos firewalls have a wireless network interface called GuestAP. Normally, this isn’t much of an issue, but if you don’t plan to use Sophos Wireless, it doesn’t make sense to keep the GuestAP network interface.

In this post, I will show you step by step how to remove the GuestAP network interface on SFOS (Sophos Firewall Operating System).

The Process

  • Login to the Sophos firewall.
  • Click on Protect > Wireless.
…

Read More Read More

Palo Alto Configure Master Key with HA (Active/Passive)

Palo Alto Configure Master Key with HA (Active/Passive)

When you enter a private key or a password on a Palo Alto Networks firewall, it is encrypted with a master key. Out of the box, all Palo Alto firewalls use the same default master key, which used to be p1a2l3o4a5l6t7o8.

If your Palo Alto firewall uses the default master key and someone gets a copy of your firewall configuration, they may be able to decrypt the private keys and passwords stored in it. Fortunately, you can prevent this easily by configuring the master key to something unique.

In this post, I will show you step by step how to set your own master key on a Palo Alto Networks firewall in an Active/Passive High Availability Pair using the GUI and the CLI.

The Process

  • Backup your Palo Alto firewall config.

For more information on how to back up your Palo Alto firewall config, my blog post, Palo Alto Config Backup, goes into detail.

Disable HA Config Sync

We need to disable HA configuration synchronization on both firewalls while we configure the master key on each firewall.

Disable HA Config Sync GUI

  • On the Primary firewall, click on the Device tab.
  • Click on High Availability.
  • Click on the General tab.
  • In the HA Pair Settings, click on the gear icon in the Setup box.
  • Uncheck Enable Config Sync and click OK.
  • Commit the change.
  • Repeat the process on the Secondary firewall.

Disable HA Config Sync CLI

  • SSH into the Primary firewall.
  • Enter configuration mode with the command configure
  • Run the following command to check your current HA config sync settings show deviceconfig high-availability group configuration-synchronization

If enabled is set to yes, we need to disable it.

…

Read More Read More

Palo Alto Config Backup

Palo Alto Config Backup

It’s important to back up your Palo Alto Networks firewall configuration, as it is useful in the event of a system failure, configuration error, or other unforeseen circumstances.

In this post, I will show you, step by step, how to backup your Palo Alto Networks firewall config using the GUI or CLI.

The Process

  • Login to the Palo Alto Networks firewall.

GUI

  • Click on Device.
  • Click on Setup.
  • Click on Operations.
…

Read More Read More

ESX Regenerate Self-Signed Certificate

ESX Regenerate Self-Signed Certificate

During the installation of VMware ESX, you’re never prompted to set a hostname or domain name. As a result, ESX defaults to the hostname localhost and the domain localdomain. Due to this when ESXi generates a self-signed certificate, it is for localhost.localdomain.

In this post, I will show you step by step how to regenerate the self-signed certificate for ESX.

Prerequisites

  • The ESXi hostname has been changed.

For more information about changing the ESXi hostname, my blog post, ESXi changing the host name goes into detail.

The Process

  • Connect to your ESXi host.
  • Right-click on the ESXi host and select Services > Enable Secure Shell (SSH).
  • SSH into the ESXi host.
  • To view the current certificate installed on your ESXi host, run the following command openssl x509 -noout -subject -in /etc/vmware/ssl/rui.crt

If you want to view all the details about your ESXi certificate, run the following command  openssl x509 -noout -in /etc/vmware/ssl/rui.crt -text

…

Read More Read More

Veeam Backup & Replication 13 Windows Install

Veeam Backup & Replication 13 Windows Install

Veeam Backup & Replication is a wonderful product that I’ve been using for years. I’ve used it many times to recovery from various situations, and it’s been a real lifesaver.

VBR (Veeam Backup & Replication) is backup software that can back up your systems, whether they are bare-metal, cloud, or VMs. VBR supports various hypervisors, including VMware, Hyper-V, Nutanix, Proxmox, and others, and has expanded its support to include backing up raw file shares or object storage. Veeam keeps adding more and more features to VBR. VBR is part of the Veeam Data Platform.

In this post, I will show you step by step how to install Veeam Backup & Replication 13 on Windows.

Prerequisites

You need a server with the following.

  • Windows Server 2016 or newer.
  • 8 CPU cores or more.
  • 16 GB RAM or more.
  • 130GB disk space.
    • 5 GB for the Veeam Backup & Replication installation.
    • 4.5 GB for Microsoft .NET Framework.
    • 10 GB per 100 backed up VMs.
    • 100 GB for instant recovery cache folder.
    • 10 GB for Logs.
  • Port 443 is available.

The required disk space doesn’t all have to be on the C drive. For this post, I’ll keep it on the C drive.

The Process

  • Mount the VBR ISO.
  • Run Setup.exe.
  • On the VBR 13 install splash screen, click on Install.
  • Click on Install Veeam Backup & Replication.
  • Wait while the setup wizard is initialized.
…

Read More Read More

Enable Windows 10 Extended Security Updates

Enable Windows 10 Extended Security Updates

On October 14, 2025, Windows 10 reached end of life and no longer receives updates. To keep getting updates, you must upgrade to Windows 11 or enroll in the Windows 10 ESU (Extended Security Updates) program.

In this post, I will show you step by step how to enable the commercial Windows 10 Extended Security Updates and how to mange ESU in non-persistent VDI setups.

Perquisites

  • Windows 10 ESU MAK.

Once you have purchased Windows 10 ESU, you will receive a MAK (Multiple Activation Key).

  • Windows 10 version 22H2.
    • Windows 10 LTSB or LTSC are not eligible for ESU.
  • The following updates must be installed.
    • 2025-10 Cumulative Update for Windows 10 Version 22H2 (KB5066791) or newer.
      • 2025-11 Security Update for Windows 10 Version 22H2 (KB5072653) installed after KB5066791.

The Process

  • Open Command Prompt or PowerShell as admin.

We will use slmgr.vbs which you can use directly or call it from csript. I will call it from csript to keep everything in the command line window. To use csript with slmgr.vbs we just need to prefix the slmgr.vbs command with cscript C:\Windows\System32\.

If you want to read more about slmgr.vbs, my blog post slmgr.vbs goes into detail.

  • First, we need to install the Windows 10 ESU MAK product key. We will do this with the following command slmgr.vbs /ipk YOUR_ESU_PRODUCT_KEY replace YOUR_ESU_PRODUCT_KEY with your Windows 10 ESU MAK product key.

Next, we need to activate the specific ESU component by using its Activation ID.

…

Read More Read More

slmgr.vbs

slmgr.vbs

slmgr.vbs is the Windows Software Licensing Management Tool, a Microsoft Visual Basic script that comes with Windows and is a core part of the Windows activation system. The full path is C:\Windows\System32\slmgr.vbs.

You can use slmgr.vbs to troubleshoot, activate, change, and uninstall your Windows activation.

In this post, I will show you how to use slmgr.vbs.

Product Key

Windows commonly uses product keys to activate. A Windows product key consists of 5 blocks of 5 alphanumeric characters, totaling 25 characters.

Typically, the following characters are never in a product key: A, E, I, L, O, S, U, Z, 0, 1.

Most product keys are unique, but that isn’t always the case.

  • GVLK (Generic Volume License Key) keys are all the same because Windows won’t fully activate unless it can reach out to a KMS (Key Management Service) host.
  • MAK (Multiple Activation Key) are semi unique product keys. When an organization is issued a MAK, the same product key can be used a limited number of times before it stops working.
  • Generic Retail Keys (sometimes called RTM Keys) are the same product key and are typically used to upgrade from one Windows edition to the next. After the upgrade, a valid product key is needed.
  • AVMA (Automatic Virtual Machine Activation) product keys are all the same because they only activate when running as a guest on a Hyper-V host running an activated version of Windows Server Datacenter.

Application ID

An Application ID is a unique ID for each core component that can be activated with slmgr.vbs.

For example, the Application ID 55c92734-d682-4d71-983e-d6ec3f16059f is for Windows, and 0ff1ce15-a989-479d-af46-f275c6370663 is for Office.

Activation ID

An Activation ID is a unique ID for each component that can be activated. There are a lot of them.

Confirmation ID

A Confirmation ID is typically only provided by Microsoft when activating offline.

Output

By default, slmgr.vbs will output to a new window.

However, if you call slmgr.vbs with cscript instead, you can output everything to the command line.

For example

cscript c:\Windows\System32\slmgr.vbs /ato

Options

ipk

Install Product Key.

  • If you use /ipk with a product key, it installs or replaces the current product key.
…

Read More Read More

CyberChef

CyberChef

CyberChef is a web application with an abundance of tools, including decoding and encoding to and from various formats such as Base64, ROT13, XOR, and Hex. It is often referred to as the Cyber Swiss Army Knife, and I can see why. There are over 400 tools.

I’ve personally used CyberChef on many occasions, most commonly to decode Base64 or PEM certificates. To this day, I am still discovering new tools within CyberChef. Most recently, I’ve found a tool called Magic that helps you decode items with multiple layers of encoding.

A really cool thing about CyberChef is that it is developed and maintained by the GCHQ (Government Communications Headquarters) in the UK, which is the UK’s cyber, security, and intelligence agency.

In this post, I will show you how to use CyberChef and how to host it yourself with Docker and a Cloudflare tunnel.

Using CyberChef

Accessing CyberChef

If you search for CyberChef, there are a few versions online, but the only official version is hosted on the GCHQ GitHub, which can be accessed at https://gchq.github.io/CyberChef/

CyberChef Layout

Once you have accessed CyberChef, you will see four main panels.

The first panel is the tools, also known as operations. The next panel is the recipe. The next two panels are the input and the output.

Baking

To use CyberChef, you need to bake it. Baking consists of using operations to make a recipe.

To make a recipe, you need to drag an operation onto the recipe panel.

For example, if I wanted to decode the following Base64 string VGhpcyBpcyBCYXNlNjQgaW4gQ3liZXJDaGVm.

I would drag the From Base64 operation over to the recipe panel.

…

Read More Read More