Execute a low-level, generic Sophos Firewall XML API operation.

Use when executing custom or low-level SFOS XML API calls for tags or configuration settings not supported by dedicated high-level tools.

Args: operation: API operation type ('Get', 'Set', or 'Remove'). tag: Target Sophos XML entity tag. params: Optional payload dictionary or search filter criteria. client: Optional SophosFirewallClient instance.

Returns: Parsed API response dictionary or object list.

Retrieve system information including appliance model, firmware version, serial number, and uptime.

Use when inspecting hardware/firmware details and overall system status.

Args: client: Optional SophosFirewallClient instance.

Returns: System information parameters from Sophos Firewall.

Retrieve current operational status of system services (DNS, DHCP, IPS, Web Protection, AntiVirus).

Use when monitoring background service health or diagnosing firewall subsystem failures.

Args: client: Optional SophosFirewallClient instance.

Returns: Status details of core firewall services.

List network interfaces with configuration, IP addresses, network zones, and link state.

Use when inspecting physical or virtual interface configurations, subnets, and link states.

Args: client: Optional SophosFirewallClient instance.

Returns: List or dict of network interface configurations.

List firewall security rules configured on the appliance.

Use when browsing security policies or searching for rules matching a specific name.

Args: name: Optional firewall rule name filter. client: Optional SophosFirewallClient instance.

Returns: List or dict of firewall rule configurations.

Retrieve details for a specific firewall rule by name.

Use when inspecting full policy configuration for a single firewall rule.

Args: name: Name of the firewall rule. client: Optional SophosFirewallClient instance.

Returns: Firewall rule configuration.

Create a new IPv4 firewall security rule.

Use when defining new network access control policies between zones and host objects.

Args: name: Unique name for the firewall rule. action: Rule policy action ('Accept', 'Drop', or 'Reject'). Default is 'Accept'. source_zones: List of source network zone names (e.g. ['LAN']). destination_zones: List of destination network zone names (e.g. ['WAN']). source_networks: List of source host/network object names (e.g. ['Any']). destination_networks: List of destination host/network object names (e.g. ['Any']). services: List of service object names (e.g. ['HTTP', 'HTTPS']). status: Rule status ('Enable' or 'Disable'). Default is 'Enable'. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

Update configuration fields on an existing firewall rule.

Use when modifying parameters such as logging, action, zones, host objects, or status on an existing security policy.

Args: name: Name of the firewall rule to update. action: Optional new rule policy action ('Accept', 'Drop', or 'Reject'). source_zones: Optional list of source network zone names. destination_zones: Optional list of destination network zone names. source_networks: Optional list of source host/network object names. destination_networks: Optional list of destination host/network object names. services: Optional list of service object names. log_traffic: Optional logging setting ('Enable' or 'Disable'). status: Optional rule status ('Enable' or 'Disable'). client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

Enable or disable an existing firewall rule.

Use when toggling a security policy active state without deleting the rule.

Args: name: Name of the firewall rule. status: Desired state ('Enable' or 'Disable'). client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

Delete a firewall rule by name.

Use when permanently removing an obsolete security policy.

Args: name: Name of the firewall rule to delete. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

List IP host objects defined on Sophos Firewall.

Use when browsing IP address, network subnet, or IP range objects.

Args: name: Optional IP host name filter. client: Optional SophosFirewallClient instance.

Returns: List or dict of IP host objects.

Retrieve configuration details for a specific IP host object.

Use when inspecting target IP address or subnet definition for an object.

Args: name: Name of the IP host object. client: Optional SophosFirewallClient instance.

Returns: IP host configuration.

Create a new IP host object (IP Address, Network, IP Range, or IP List).

Use when registering host IP or network subnet definitions for firewall policies.

Args: name: Unique name for the host object. host_type: Type of host object ('IP', 'Network', 'IPRange', or 'IPList'). Default is 'IP'. ip_address: IP address or starting IP address/subnet. subnet_mask: Subnet mask if host_type is 'Network' (e.g. '255.255.255.0' or '24'). ip_family: IP protocol family ('IPv4' or 'IPv6'). Default is 'IPv4'. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

Delete an IP host object by name.

Use when deleting unused IP host objects from the firewall database.

Args: name: Name of the IP host to remove. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

List IP host groups configured on Sophos Firewall.

Use when viewing grouped IP host definitions used in rule sets.

Args: name: Optional group name filter. client: Optional SophosFirewallClient instance.

Returns: List or dict of IP host groups.

Create an IP host group containing multiple IP host objects.

Use when bundling multiple IP host objects together for unified security policies.

Args: name: Unique name for the host group. host_list: List of IP host object names to include in the group. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

Delete an IP host group by name.

Use when deleting an obsolete host group object from Sophos Firewall.

Args: name: Name of the host group to remove. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

List FQDN (Fully Qualified Domain Name) host objects.

Use when inspecting domain-based network host objects.

Args: name: Optional FQDN host name filter. client: Optional SophosFirewallClient instance.

Returns: List or dict of FQDN host objects.

Create a new FQDN host object.

Use when defining domain name target objects for firewall or NAT rules.

Args: name: Unique name for the FQDN host object. fqdn: Fully qualified domain name (e.g. 'api.example.com'). client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

Delete an FQDN host object by name.

Use when deleting domain-based host objects from Sophos Firewall.

Args: name: Name of the FQDN host object to remove. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

List service objects (TCP, UDP, ICMP, IP protocol definitions).

Use when inspecting custom or predefined port and protocol definitions.

Args: name: Optional service name filter. client: Optional SophosFirewallClient instance.

Returns: List or dict of service definitions.

Retrieve details of a specific service definition.

Use when verifying target port ranges or protocol parameters for a service.

Args: name: Name of the service object. client: Optional SophosFirewallClient instance.

Returns: Service definition configuration.

Create a custom TCP/UDP service definition.

Use when adding new port or protocol definitions for firewall rules.

Args: name: Unique name for the service definition. protocol: Protocol type ('TCP', 'UDP', 'TCP/UDP', or 'ICMP'). Default is 'TCP'. source_port: Source port range (e.g. '1:65535'). Default is '1:65535'. destination_port: Destination port or port range (e.g. '8080' or '8000:8080'). client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

Delete a custom service definition object by name.

Use when deleting obsolete service port definitions from Sophos Firewall.

Args: name: Name of the service object to delete. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

List service group objects configured on Sophos Firewall.

Use when browsing bundled groups of services used in rule policies.

Args: name: Optional service group name filter. client: Optional SophosFirewallClient instance.

Returns: List or dict of service groups.

Create a new service group object.

Use when bundling multiple service port definitions into a single named group for security rules.

Args: name: Unique name for the service group. service_list: List of service object names to include in the group. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

Delete a service group object by name.

Use when removing an obsolete service group definition from Sophos Firewall.

Args: name: Name of the service group to remove. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

List NAT and DNAT port-forwarding rules on Sophos Firewall.

Use when reviewing Network Address Translation rules and port forwarding.

Args: name: Optional NAT rule name filter. client: Optional SophosFirewallClient instance.

Returns: List or dict of NAT rules.

Retrieve detailed configuration of a specific NAT rule.

Use when auditing original/translated source, destination, and service parameters.

Args: name: Name of the NAT rule. client: Optional SophosFirewallClient instance.

Returns: NAT rule configuration details.

Create a Network Address Translation (NAT or DNAT) rule.

Use when defining port forwarding, SNAT masquerading, or DNAT inbound translation rules.

Args: name: Unique name for the NAT rule. status: Rule status ('Enable' or 'Disable'). Default is 'Enable'. original_source: Original source host/network object names. original_destination: Original destination host/network object names. original_service: Original service object names. translated_source: Translated source object ('MASQUERADE', 'Original', etc.). translated_destination: Translated destination host/network object. translated_service: Translated service object name. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

Update fields on an existing NAT rule.

Use when updating status or target translation parameters on an existing NAT or port-forwarding rule.

Args: name: Name of the NAT rule to update. status: Optional new status ('Enable' or 'Disable'). translated_source: Optional new translated source object. translated_destination: Optional new translated destination object. translated_service: Optional new translated service object. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

Delete a NAT rule by name.

Use when permanently removing a NAT or port-forwarding policy.

Args: name: Name of the NAT rule to remove. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

List local user accounts configured on Sophos Firewall.

Use when browsing local user accounts and group memberships.

Args: username: Optional username filter. client: Optional SophosFirewallClient instance.

Returns: List or dict of user accounts.

Retrieve details for a specific local user account.

Use when inspecting permissions, email, or profile settings for a user.

Args: username: Username of the user account. client: Optional SophosFirewallClient instance.

Returns: User account details.

Create a new local user account on Sophos Firewall.

Use when registering new local user accounts for VPN or portal access.

Args: username: Login username for the account. name: Full display name of the user. password: User login password. group: User group name (e.g. 'Open Group' or 'Administrator'). Default is 'Open Group'. email: Optional user email address. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

Delete a local user account by username.

Use when removing obsolete or revoked user accounts from Sophos Firewall.

Args: username: Username of the account to delete. client: Optional SophosFirewallClient instance.

Returns: API response status dictionary.

List active logged-in user sessions on Sophos Firewall.

Use when monitoring live user logins, active session counts, or connected users.

Args: client: Optional SophosFirewallClient instance.

Returns: List or dict of live user sessions.

List IPsec site-to-site VPN connection configurations and status.

Use when inspecting site-to-site IPsec tunnel states and gateway parameters.

Args: client: Optional SophosFirewallClient instance.

Returns: List or dict of IPsec VPN connections.

List SSL VPN remote access policies configured on Sophos Firewall.

Use when viewing user access policies, SSL VPN IP pools, and permitted networks.

Args: client: Optional SophosFirewallClient instance.

Returns: List or dict of SSL VPN remote access policies.

Find relevant Sophos Firewall tools matching a natural language prompt.

Args: query: Natural language task description or question. top_k: Number of relevant tools to return. Default is 5.

Returns: List of matching tool schema definitions or status string.

Dynamically execute a routed tool by name with arguments.

Args: tool_name: Name of the registered tool to call. arguments: Optional dictionary of arguments to pass to the tool function.

Returns: Result of the executed tool function.