Sophos Firewall (SFOS) — Custom Integration via XML API + SNMP
Suggested tags: integration, hacs, firewall, network
I’ve been running a Sophos firewall at home for a while and got tired of not having any of it visible in Home Assistant. So I built an integration for it — fully local, no cloud, no third-party service in between.
It talks to the firewall over the XML API (port 4444) and SNMP, and gives you the state of your interfaces, VPN tunnels, DHCP servers, licences, services and system health as proper HA entities.
What you get
| Category | Entities |
|---|---|
| Interfaces | Connected/disconnected, zone, IP assignment |
| Firewall rules | Read-only sensor, or a switch if you enable write access |
| DHCP | Server status + lease count, full lease list as an attribute |
| System | RAM, disk, swap (%), uptime, backup frequency |
| Connections | HTTP, SMTP, IMAP, POP3, FTP hits, captive portal users |
| Services | Aggregate sensor (19 / 21 running) with running/stopped lists as attributes |
| VPN tunnels | IPSec tunnels with connection status |
| High availability | Cluster status plus the role of this node and its peer |
| Licences | Aggregate sensor (8 / 9 OK) with next expiry date |
| Security | Web filter default action, IPS signature version, webcat version |
| Hardware health | CPU/NPU temperature, fan RPM, PSU status (physical appliances only) |
| Control | Trigger a backup, toggle firewall rules and web filter policies |
Firewall rules and web filter policies land in the config section of the device page rather than the main view, so they don’t clutter your dashboard — but they’re still fully usable in automations.
A few things I paid attention to
Tiered polling. Not everything needs to be fetched every 30 seconds. Interfaces and stats poll fast; licences and DHCP poll slowly; device info is fetched once at startup. All five tiers are configurable in the options. Write operations (flipping a switch, triggering a backup) immediately refresh the affected tier rather than waiting for the next cycle.
Virtual appliance detection. If you run SFVH, the integration notices there’s no CPU temperature or fans and stops polling hardware health entirely.
Multi-firewall. Each firewall gets its own device and its own coordinator — several instances work side by side.
Read-only by default. Write access (rule/policy switches, backup button) is an explicit opt-in during setup. If you don’t turn it on, the integration can only read.
Requirements
- Home Assistant 2024.9+
- Sophos Firewall SFOS 20.x or 22.x (developed and tested against 22.0.0 on an SFVH)
- API access enabled on the firewall: Network → Administration → Device Access → enable HTTPS admin
- Optional, for the SNMP-based sensors: System → Administration → SNMP → configure a community string
SNMP is optional but unlocks a large part of the sensors (VPN, HA cluster, licences, services, hardware health), so I’d recommend enabling it.
Install
Currently a HACS custom repository — add the repo URL under HACS → Integrations → ⋮ → Custom repositories (category: Integration), then install and restart. I’m working on getting it into the HACS default store.
Setup is entirely through the UI: host, port, credentials, then optional SNMP and write access.
State of things
It’s at v1.0.2, meets the Bronze/Silver/Gold quality scale rules, and has a test suite of 164 tests behind it. It’s been running against my own firewall continuously and a couple of people have been kind enough to file issues that turned up real bugs — those are fixed.
I’d particularly like to hear from anyone running:
- Physical appliances (XG/XGS) — I only have a virtual one, so the temperature/fan/PSU sensors are the least exercised part
- HA clusters — the cluster entities are new and I’d like to know the reported roles actually match reality
- SFOS 20.x — developed against 22.x, should work but I can’t test it
Issues and feedback very welcome. If something doesn’t show up or a value looks wrong, open an issue with your SFOS version and I’ll take a look.