This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos and Big Sur Upgrade?

I just upgraded from Catalina to Big Sur (11.0.1) and Sophos gives me an error message : "You need to change your 'Siecurity & Privacy' settings." When I do that, does not register the change and I am caught in a loop. Is Sophos not compatible with Big Sur or are these messages wrong? Help would be appreciated.

This thread was automatically locked due to age.

Top Replies

FormerMember over 4 years ago in reply to Bryant Ly +1 verified

Hi Bryant Ly , Did you configure the Default L2TP policy on the XG firewall with the L2TP connection? If yes, please clone it, and remove the SHA2 with 96-bit truncation and update the cloned L2TP policy…

0 emmosophos over 4 years ago

Hello Geoff,

Thank you for contacting the Sophos Community!

What is the Sophos Product you are using?

If it is Sophos Endpoint, then it is not supported on Big Sur for now, you can take a look at this KB

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Geoff Browning over 4 years ago in reply to emmosophos

I think it is probably Endpoint but not sure. How can I determine that for sure? It won't even start up but prompts me to begin an install that fails.

I would not have upgraded to Big Sur if I had known about this incompatibility. :-(
Cancel
Vote Up 0 Vote Down

Cancel
0 Geoff Browning over 4 years ago in reply to Geoff Browning

And one other thing, do I have to deinstall Sophos to get it to stop prompting me to fix it?
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 4 years ago in reply to Geoff Browning

Hi,

if you do a restart and wait a little I suspect it will download an update, my sophos home premium did and stopped with the issue.

Ian

XG115W - v20.0.3 MR-3 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 4 years ago in reply to Geoff Browning

Hello Geoff,

Please take a screenshot of the product, since most likely it is Endpoint related, I will be moving this thread to a different group.

If the issue is with Sophos Home, please reach out to them via https://support.home.sophos.com/hc/en-us or directly via twitter @SophosHome

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Bryant Ly over 4 years ago in reply to emmosophos

Does l2tp with Sophos XG work?

Upon upgrade to Big Sur, I can no longer connect to work VPN that uses l2tp via Sophos XG.

From research Apple seems to say:

From Apple to the feedback. The message is below:

Hello. We have upgraded the proposed ciphers in L2TP IPsec VPN to also propose SHA-256 for the Child SA in IPsec. The issue seems to be that the server is accepting SHA-256 cipher for the child but maybe dropping the ESP encrypted packets with SHA-256 HMAC. This may be because the server is performing a SHA-256 HMAC with 96 bits output instead of the standard expected 128 bits. This appears to be an issue for the VPN provider to resolve. Switching the SHA-256 HMAC output from 96 to 128 bits on the server should fix this issue.
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Bryant Ly

Hi Bryant Ly,

Did you configure the Default L2TP policy on the XG firewall with the L2TP connection? If yes, please clone it, and remove the SHA2 with 96-bit truncation and update the cloned L2TP policy as per the following screenshot, let us know if that resolves your issue. If it does not, we would need to check the strongswan logs in debugging on XG.

Thanks,
Cancel
Vote Up +1 Vote Down

Cancel
0 Bryant Ly over 4 years ago in reply to FormerMember

By changing to just 256 fixed the issue. Thanks
Cancel
Vote Up 0 Vote Down

Cancel