Sophos XGS 5500 User manual

Operating Instructions
XGS 5500/6500

2XGS 5500/6500
Operating Instructions
Foreword
We are pleased to welcome you as a new customer of our Sophos XGS appliances.
To install and configure the hardware appliance you can use the following documents:
Hardware Quick Start Guide: Connection to the system peripherals in a few steps
Operating Instructions: Notes on the security and commissioning of the hardware
appliance
Sophos Firewall How-To Library: Installing and configuring the software appliance
The Hardware Quick Start Guide and the Safety Instructions are also delivered in printed
form together with the hardware appliance. The instructions must be read carefully prior to
using the hardware and should be kept in a safe place.
You may download all user manuals and additional documentation from the support
webpage at: sophos.com/support
Security Symbols
The following symbol and its meaning appears in the Hardware Quick Start Guide, Safety
Instructions and in these Operating Instructions.
Caution and Important Note. If these notes are not correctly observed:
ÌThis is dangerous to life and the environment
ÌThe appliance may be damaged
ÌThe functions of the appliance will be no longer guaranteed
ÌSophos shall not be liable for damages arising from a
failure to comply with the Safety Instructions
Designed Use
The hardware appliances are developed for use in networks. The XGS 5500/6500 models
may be operated as a standalone appliance. The hardware appliance can be used in
commercial, industrial and residential environments.
The XGS 5500/6500 models belong to the appliance group A.
The hardware appliance must be installed pursuant to the current installation notes.
Otherwise failure-free and safe operation cannot be guaranteed. The EU declaration of
conformity is available at the following address:
Sophos Technology GmbH
Amalienbadstr. 41/Bau 52
76227 Karlsruhe
Germany

3XGS 5500/6500
Operating Instructions
CE Labeling, FCC and Approvals
The XGS 5500/6500 appliances comply with FCC Class A, CE, C-Tick, VCCI and UL.
Important Note: For computer systems to remain CE and FCC compliant, only CE and FCC
compliant parts may be used. Maintaining CE and FCC compliance also requires proper
cable and cabling techniques.
Operating Elements and Connections
XGS 5500
1 x expansion bay (shown
with optional module)
COM: Micro USB, RJ45,
2 x USB 3.0, MGMT port
2 x expansion bay
(shown with
optional modules)
F1–F4/F5–F8
fiber ports
LAN 1–8: 8 x GbE copper –
fixed. Incl. 2 bypass pairs
(ports 1/2 and 3/4)
Multi-function
LCD display and
navigation
XGS 6500
2 x expansion bay (shown
with optional modules)
COM: Micro USB, RJ45,
2 x USB 3.0, MGMT port
2 x expansion bay
(shown with
optional modules)
F1–F4/F5–F8/
F9–F12 fiber ports
LAN 1–8: 8 x GbE copper –
fixed. Incl. 2 bypass pairs
(ports 1/2 and 3/4)
Multi-function
LCD display and
navigation
XGS 5500/6500
2 x hot swappable
power supplyESD grounding point
Power switch Chassis grounding
connections

4XGS 5500/6500
Operating Instructions
Interfaces (front)
LAN Ports Type Speed Comment
1–8 RJ45 10/100/1000 Mbps Ports 1/2 and 3/4 can be configured
as independent bypass pairs.
F1–F8 SFP+ 1/10 Gbps SFP/SFP+ transceivers are sold separately.
F9–F12
(XGS 6500 only)
SFP+ 1/10 Gbps
Other Ports Type Comment
COM RJ45/Micro USB You can connect a serial console to either the RJ45 or
micro USB COM port to access the CLI. Only one port
can be used at any time. If both ports are connected
then the micro USB port will take precedence.
The required connection settings are:
ÌBits per second: 38,400
ÌData bits: 8
ÌParity: N (none)
ÌStop bits: 1
USB USB 3.0 (Type A) You can connect a USB 2.0 or 3.0 compatible device to
this port (e.g. USB thumb drive, UPS, 3G/4G dongles.
MGMT RJ45 (10/100/1000 Mbps) We recommend using this dedicated
port to connect your Admin PC.
Module Slots Type Comment
A/B Flexi Port Can be used for any Flexi Port module
listed in the table below.
C/D
(D on XGS 6500 only)
Network Interface Card (NIC) Can be used for the NIC Module listed in the table below.
Compatible Modules*Comment
8 port GbE copper Flexi Port
8 port GbE SFP Flexi Port
8 port 10 GbE SFP+ Flexi Port
4 port GbE copper – 2 Bypass groups Flexi Port
2 port 40 GbE QSFP+ Flexi Port
4 port 10 GbE SFP+ Flexi Port
12 port GbE copper + 4 port 2.5 GbE copper** High-density Flexi Port
* SFP/SFP+/QSFP transceivers are sold separately.
**Please note: For electromagnetic reasons, please only use shielded RJ45 Ethernet cables on the indicated ports of this module.

5XGS 5500/6500
Operating Instructions
Technical Specifications
XGS 5500 XGS 6500
Physical Specification
#Fixed Ethernet Ports 16 20
#Fixed ByPass Port Pairs 2 2
max. #Flexi Ports 32 48
#Cores Main CPU 16/32 24/48
Main Memory 64GB DDR4 ECC 2666 80GB DDR4 ECC 2666
#Cores NPU 24 24
NPU Memory 12GB DDR4 ECC 12GB DDR4 ECC
Stoarge 2 x 480 GB HW RAID-1 2 x 480 GB HW RAID-1
Power Supply 1+1 Internal auto-ranging
100-240VAC, 50-60 Hz hot swap
1+1 Internal auto-ranging
100-240VAC, 50-60 Hz hot swap
Power Consumption (idle) 168.0W/573.81 BTU/h 188.00 W/642.13 BTU/h
Power Consumption (full load) 478.01W/1117.43 BTU/h 497.09 W/1697.8 BTU/h
Mounting 2U sliding rails (included)
min. rack depth: 588mm (23.125”)
max. rack depth: 870mm (34.25”)
2U sliding rails (included)
min. rack depth: 588mm (23.125”)
max. rack depth: 870mm (34.25”)
Dimensions
Width x Depth x Height
438 x 660 x 88 mm
17.24 x 25.98 x 3.46 inches
438 x 660 x 88 mm
17.24 x 25.98 x 3.46 inches
Weight (kg) unpacked/packed 17.8 kg/39.24 lbs (unpacked)
27 kg/59.53 lbs (packed)
17.8 kg/39.24 lbs (unpacked)
27 kg/59.53 lbs (packed)
Environmental
Noise level (avg.)
(Typical/Max Operation)
58.3/64.2 dBA 58.3/64.2 dBA
Operating Temperature 0°C to 40°C 0°C to 40°C
Storage Temperature -20°C to 70°C -20°C to 70°C
Operational/Storage Humidity 10% to 90% non-condensing 10% to 90% non-condensing
Operational/Storage Altitude 2000/5791 m 2000/5791 m
MTBF (hours)
(Telcordia SR-332 Issue 3)
135099 135099
Certifications (Safety, EMC) CB, CE, UL, FCC, ISED, VCCI, CCC,
KC, BSMI, RCM, NOM, Anatel
CB, CE, UL, FCC, ISED, VCCI, CCC,
KC, BSMI, RCM, NOM, Anatel
LED Status
Status LEDs
Power 1
(Upper Power
Supply)
Green Solid Power Supply 1 Active.
Red Solid Power Supply 1 Failure.
Off Power Supply not present
Power 2
(Lower Power
Supply)
Green Solid Power Supply 2 Active.
Red Solid Power Supply 2 Failure.
Off Power Supply not present
SSD Blue Flashing SSD reading/writing data.
BP 1/2 Green Solid Bypass mode on Ports 1/2 enabled.
Off Bypass mode on Ports 1/2 disabled and inactive.
BP 3/4 Green Solid Bypass mode on Ports 3/4 enabled.
Off Bypass mode on Ports 3/4 disabled and inactive.
LEDs on each RJ45 Ethernet connector
ACT/LNK
(Left LED)
Green Solid 1. The Ethernet port has established link.
2. Good connection between the Ethernet port and hub.
Flashing The adapter is sending or receiving network data.
Off 1. The adapter and switch are not receiving power.
2. No connection between both ends of network.
3. Network drivers have not been loaded
or do not function correctly.
Speed
(Right LED)
Amber On If Ethernet port is operating at 1000 Mbps.
Green On If Ethernet port is operating at 100 Mbps.
Off If Ethernet port is operating at 10 Mbps.

6XGS 5500/6500
Operating Instructions
LEDs on each SFP+ connector
ACT/LNK
(Left LED)
Green Solid 1. The SFP+ connector is receiving power.
2. Good connection between the SFP+ port and hub.
Flashing The adapter is sending or receiving network data.
Off 1. The adapter and switch are not receiving power.
2. No connection between both ends of network.
3. Network drivers have not been loaded
or do not function correctly.
Speed
(Right LED)
Blue On If SFP+ connector is operating at 10,000 Mbps.
Amber On If SFP+ connector is operating at 1,000 Mbps.
Off Either the LED is not working or the SFP+ connector
is operating at a speed below 1,000 Mbps.
Back side
Power Supply Green Solid Power
Off No power
LCD and Control Keys
The XGS 5500/6500 have an LCD and an operating unit with four membrane keys. In the
LCD, 16 characters per line can be displayed.
While the security appliance is booting this message is displayed
Firmware Version
SOPHOS
Protection
Firmware Version
SFOS xx.xx.xx

7XGS 5500/6500
Operating Instructions
LCD Menu Details
Firmware Version SFOS xx.xx.xx
Main Menu
1. System Menu
System Menu
1. Show Date
Fri 16 Apr 2021
12:54:32 GMT
Port A1[LAN] System Menu
2. Show Uptime
System uptime
0 days 0:26
System Menu
3. Show CPU
CPU Usage
0.00%
System Menu
4. Show Memory
Memory Usage
Used: 7.60%
System Menu
5. Show LoadAvg
Load Average
0.89 0.89 0.78
System Menu
6. Show Disk
Show Disk
1. Total Usage
Total Disk Usage
0.02
Show Disk
1. Detail Usage
Root 1%
Temp 0%
Config 9%
Signature 1%
System Menu
7. Live Users
Live Users
0
Main Menu
2. Network Menu
Network Menu
1. Show Port A1[LAN]
Port A1[LAN]
172.16.16.16
Network Menu
2. Show Port A2[WAN]
Port A2[WAN]
IP NOT ASSIGN
Network Menu
3. Show Port A3[NA]
Port A3[NA]
IP NOT ASSIGN
Network Menu
4. Show All
Port A4[LAN]
172.16.16.16
PortA5[WAN]
IP NOT ASSIGN
Port A6[NA]
IP NOT ASSIGN
Port A7[NA]
IP NOT ASSIGN
Port A8[NA]
IP NOT ASSIGN
Port A9[NA]
IP NOT ASSIGN
Network Menu
5. Show Gateway
GW1: PortA2
10.0.0.254
Main Menu
3. Firmware Menu
Network Menu
1. Show Firmware
FW1=SFOS
15.01.0 Beta
Network Menu
2. Factory Reset
Factory Reset
1. v to Cont.
Factory Reset
2. Confirm
Network Menu
3. Shutdown
Shutdown
1. v to Cont.
Shutdown
1. Confirm
Network Menu
4. Reboot
Reboot
1. v to Cont.
Reboot
1. Confirm
Main Menu
4. HA Info
Not Configured

8XGS 5500/6500
Operating Instructions
Executable Actions
ÌFactory reset: All settings are reset to the factory settings. The factory reset
function sets all of the configuration settings and options to their original state. All
data entered after the initial installation will be deleted, including the HTTP proxy
cache, the entire email queue, accounting and reporting data, passwords, and
uninstalled Up2Date packages. The version of the software will not change. That
is, all firmware and pattern updates that have been installed will be retained.
ÌShut down: The security appliance is shut down. The shut down action allows
you to turn off the system, and allows you to cleanly stop all running services.
ÌReboot machine: The security appliance is rebooted. The reboot
action will shut down the system completely and reboot.
Control Key Functions
The current menu is left. When the key is pressed a couple of times, the modifications are
discarded and the initial state will be displayed.
These keys are used to switch between the different menus and/or characters.
Pressing executes the configured action.
Factory Reset
S.NO. Action Item/press What you see on the LCD What it means
1. SOPHOS
Protection Appliance is booting
2.
Firmware Version
SFOS xx.xx.xx Appliance has finished Booting
3.
ENTER Main Menu
1. System Menu Shows Main Menu first item
4.
x2
Main Menu
3. Firmware Menu Shows Main Menu Third item
5.
ENTER Firmware Menu
1. Show Firmware Enters Into Firmware Menu
6. Firmware Menu
2. Factory Reset Shows Firmware Menu Second item
7.
ENTER Factory Reset
1. v to Cont. Press down key to continue
8. Factory Reset
2. Confirm? Asks for Confirmation
9.
ENTER Factory Reset under progress
10. Firmware Version
SFOS xx.xx.xx Factory Reset Complete
Esc
ENTER

9XGS 5500/6500
Operating Instructions
Shut Down
S.NO. Action Item/press What you see on the LCD What it means
1. SOPHOS
Protection Appliance is booting
2.
Firmware Version
SFOS xx.xx.xx Appliance has finished Booting
3.
ENTER Main Menu
1. System Menu Shows Main Menu first item
4.
x2
Main Menu
3. Firmware Menu Shows Main Menu Third item
5.
ENTER Firmware Menu
1. Show Firmware Enters Into Firmware Menu
6.
x2
Firmware Menu
3. Shutdown Shows Firmware Menu Third item
7.
ENTER Factory Reset
1. v to Cont. Press down key to continue
8. Factory Reset
1. Confirm? Asks for Confirmation
9.
ENTER Shutdown Complete
Reboot Machine
S.NO. Action Item/press What you see on the LCD What it means
1. SOPHOS
Protection Appliance is booting
2.
Firmware Version
SFOS 18.xx.xx Appliance has finished Booting
3.
ENTER Main Menu
1. System Menu Shows Main Menu first item
4.
x2
Main Menu
3. Firmware Menu Shows Main Menu Third item
5.
ENTER Firmware Menu
1. Show Firmware Enters Into Firmware Menu
6.
x3
Firmware Menu
4. Reboot Shows Firmware Menu Fourth item
7.
ENTER Factory Reset
1. v to Cont. Press down key to continue
8. Factory Reset
1. Confirm? Asks for Confirmation
9.
ENTER Reboot under progress
10. Firmware Version
SFOS xx.xx.xx Reboot Complete

10XGS 5500/6500
Operating Instructions
Putting into Operation
Scope of Supply
The supplied parts are indicated in the Hardware Quick Start Guide.
Mounting Instructions
The XGS 5500/6500 appliances are designed for use in racks. Please consider the
following security tips:
Important note: Functional reliability outside of a rack cannot be guaranteed.
Warnings and Precautions
The appliance can be operated safely if you observe the following notes and the notes on
the appliance itself.
Rack Precautions
ÌEnsure that the leveling jacks on the bottom of the rack are fully extended
to the floor with the full weight of the rack resting on them.
ÌIn single rack installation, stabilizers should be attached to the rack.
ÌIn multiple rack installations, the racks should be coupled together.
ÌAlways make sure the rack is stable before extending a component from the rack.
ÌYou should extend only one component at a time—extending two or
more simultaneously may cause the rack to become unstable.
General Server Precautions
ÌInstallation must be performed by qualified personnel
ÌReview the electrical and general safety precautions that came
with the components you are adding to your appliance.
ÌDetermine the placement of each component in the rack before you install the rails.
ÌInstall the heaviest server components on the bottom of the rack first, and then work up.
ÌAllow the hot plug power supply modules to cool before touching them.
ÌAlways keep the rack‘s front door, all panels and server components
closed when not servicing to maintain proper cooling.

11XGS 5500/6500
Operating Instructions
Rack Mounting Considerations
ÌAmbient operating temperature: If installed in a closed or multi-unit rack assembly,
the ambient operating temperature of the rack environment may be greater than the
ambient temperature of the room. Therefore, you should install the equipment in an
environment compatible with the manufacturer’s maximum rated ambient temperature.
ÌReduced airflow: Equipment should be mounted into a
rack with sufficient airflow to allow cooling.
ÌMechanical loading: Equipment should be mounted into a rack so that a
hazardous condition does not arise due to uneven mechanical loading.
ÌCircuit overloading: Consideration should be given to the connection of the equipment
to the power supply circuitry and the effect that any possible overloading of circuits
might have on overcurrent protection and power supply wiring. Appropriate consideration
of equipment nameplate ratings should be used when addressing this concern.
ÌReliable ground: Reliable grounding must be maintained at all times. To ensure
this, the rack itself should be grounded. Grounding screws for the appliance
are on the rear of the chassis. Chassis Grounding is required. Particular
attention should be given to power supply connections other than the direct
connections to the branch circuit (i.e., the use of power strips, etc.).
Rack Mounting Instructions
To mount the appliance to the rack you need the delivered rack-mount kits. There are a
variety of rack units on the market, which may mean the assembly procedure will differ
slightly. You should also refer to the installation instructions that came with the rack unit
you are using.
Because of their dimension and weight the XGS 5500/6500 models are delivered with a
special rail kit.
Important note: Make sure you use the screws supplied with the rack-mount brackets.
Using the wrong screws could damage the hardware appliance and would invalidate your
warranty. Please observe the mounting instructions for your rack.
1. Attach the rack-mount brackets to the appliance:
ÌPlace the appliance on a hard flat surface with the front panel facing you.
ÌAttach the rack–mount brackets to the left and right side
of the appliance with the supplied screws.
ÌMake sure the brackets are properly attached to the appliance.

12XGS 5500/6500
Operating Instructions
Important note: Please check the technical specs above for the min. and max. rack depth.
2. Choose the rack location:
ÌLeave enough clearance in front of the rack so that you can
open the front door completely (~60 cm/25 inches).
ÌLeave approximately 80 cm/30 inches of clearance in the back of
the rack to allow for sufficient airflow and ease in servicing.
ÌThis product is for installation only in a restricted access location
(dedicated equipment rooms, service closets and the like).
3. Install the sliding rails:
ÌPlease refer to the dedicated Sliding Rails Mounting
Instructions shipped with the appliance.
Connection and Configuration
How to connect the appliance is described in the Hardware Quick Start Guide. For
configuration you can follow the initial setup wizard described in the WebAdmin Quick Start
Guide or cancel it and perform a manual setup (see the Sophos Firewall How-To Library).
RAID (SSD) System
The XGS 5500/6500 models are equipped with a RAID-1 system with two Solid State
Drive. A RAID system (redundant array of independent disks) connects several physical
Solid State Drive to one particularly performing logical drive. RAID-1 enhances the data
security and consistency of your system by mirroring all data of the first SSD to the second
redundant SSD. In case one of the SSDs fail your system will still be fully operational.
However since it no longer provides SSD redundancy you should contact your local Sophos
partner to get the faulty SSD replaced as soon as possible.
Power Supply Cord Retention
Each power supply module is equipped with a plastic cord retention device.
The as-shipped state has the cord retention ring close to the power supply connector. This
will need to be moved away from the power supply in order to plug in the cord. This can be
accomplished by pulling the release tab away from the ring and sliding it along the cord
ring guide.
If the cord retention device is to be used, plug the cord into the supply and place the cord in
the retention ring and snap the ring shut, but not tight.
Slide the ring along the cord ring guide toward the power supply until it touches the cord
connector.

13XGS 5500/6500
Operating Instructions
Redundant Power Supply
The XGS 5500/6500 models are equipped with a 1+1 redundant power supply. The power
supply system consists of two separate power supply units. This power supply system
increases the availability of the security appliance, since a defective power supply unit can
be exchanged easily and quickly during operation.
When the system is running error-free, the PS1 and PS2 LEDs on the front panel will show
green. The LED on the rear of the power supply module will also show green. In the event
of a defect in a power supply (including loss of AC power or out-of-specification AC power)
the appropriate front panel LED will show red, and the LED on the rear of the power supply
module will show orange.
Important note: If you need to change a power unit because of a defect, remember to
remove the defective power unit from the power supply system, otherwise the whole
security appliance will fail.
Protect yourself from potential burns by wearing protective gloves when exchanging a
power supply unit.
Only use power units which you purchased directly from Sophos or from a Sophos
distribution partner. Please remember that any warranty claims are voided for the security
appliance if a defect has been caused by the use of power units which are not suited for the
system.
Exchanging a power supply unit
1. Remove the cord, taking care to release the cord from the cord retention device.
2. Move the green lever of the power supply to be replaced toward the center of the
chassis and, using the handle by the power supply fan, pull out the supply.
3. Plug in the replacement supply, making sure it is fully seated and that the
green handle is moved toward the edge of the channel. If the green handle
is not sufficiently moved, it will prevent the cord from being plugged in.
4. Plug the power cable back into the connector of the new power supply unit and
check the following LED displays:LED of the new power supply unit lights green.
5. Fix the cord retention
SFP/ SFP+/QSFP+ ports
The XGS 5500/6500 models offer a variety of SFP/SFP+/QSFP ports allowing you to
plugin various GBICs (transceivers) to connect to high-speed fiber or copper networks. The
abbreviation SFP GBIC stands for small form-factore plugable GigaBit interface converter, a
flexible interface which changes electronic signals into optical signals. The converters used
with the appliance are often also called Mini-GBIC or New GBIC.
To use SFP/SFP+/QSFP+ ports, you will need the appropriate transceivers or DAC cables
(combining cables and transceivers into one). These are not delivered with the appliance
but available through your Sophos partner. There are different transceiver types, and the
required type is determined by the existing network.

14XGS 5500/6500
Operating Instructions
Caution: The SFP, SFP+ and QSFP+ ports use lasers to transmit signals over fiber optic
cable. The lasers are compliant with the requirements of a Class 1 Laser equipment and
are inherently eye-safe in normal operation. However, you should never look directly at
a transmit port when it is powered on. Always install appropriate and UL approved Laser
Class I Transceivers, rated 3.3Vdc, max. 1W, in the fiber ports before using the fiber ports.
Installing a SFP/SFP+/QSFP+ module
Please read the operation manual for the module. Carefully insert the module into the port
until it engages. The interface is immediately ready for use.
Removing a SFP/SFP+/QSFP+ module
1. Remove the optical cable from the module which you wish to remove.
2. Remove the module carefully from the port.
Depending on when you purchased your module, it may have any of three different
release mechanisms: a plastic tab on the bottom of the module, a wire bail, or a plastic
collar around the module.
Please read the operation manual to the module.
Serial Console
You can connect a serial console to either the RJ45 or micro USB COM port to access the
CLI. Only one port can be used at any time. If both ports are connected then the micro USB
port will take precedence. You can use, for instance, the Hyperterminal terminal program
which is included with most versions of Microsoft Windows to log on to the appliance
console. If you want to connect to the Micro-USB COM port please use the supplied cable.
If you want to connect to the RJ45 COM port please use a RJ45 to DB9 Adapter cable (not
provided with the unit). The Pin-out for this cable is shown in the table below.
Sophos RJ45 Pinout
This pinout is compatible with Cisco Straight (X2) pinout serial cables.
Pin number Function Direction
1RTS Output
2DTR Output
3TXD Output
4Ground N/A
5Ground N/A
6RXD Input
7DSR Input
8CTS Input
The required connection settings are:
ÌBits per second: 38,400
ÌData bits: 8
ÌParity: N (none)
ÌStop bits: 1
Access via the serial console is activated by default on ttyS0. The connections of the
appliances and the respective functionality are listed in chapter ‘Operating Elements and
Connections.’

Operating Instructions
United Kingdom and Worldwide Sales
Tel: [phone]
Email: [email protected]
North American Sales
Toll Free: 1-866-866-2802
Email: [email protected]
Australia and New Zealand Sales
Tel: [phone]
Email: [email protected]
Asia Sales
Tel: [phone]
Email: [email protected]
© Copyright 2021. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned are
trademarks or registered trademarks of their respective owners.
21-06-01 OI-EN (DD)