Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 39 subscribers
  • Views 52248 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Initial reactions to Sophos XG OS

AdamTyler

Hey everyone, just want to start by saying THANK YOU Sophos for making this firewall available in the home use license form.  You've lost "0" revenue and gained a small army of experienced users who I'm sure recommend your product in their place of business because of the positive individual experience and comfort with the OS.

I downloaded the Sophos XG firewall ovf template and deployed to my home VMware cluster yesterday and spent a few hours thumbing through the interface.  I have some immediate thoughts and was curious as to what the community of users had to add.

1. Simple?  It sounds like development set out to make the firewall interface extremely simple.  Nothing more than 2 or 3 clicks away is one quote from a marketing video.  I would argue that the drive to make the product simple will alienate experienced administrators.  I'm not talking network engineers here, but it's pretty standard to have NAT and firewall policies separate.  This concept is widely used across fortigate, SonicWALL, and was beautifully executed in UTM9.  I admit that I didn't spend long, but I couldn't make sense of the firewall/NAT wizard in XG.  It appeared to go back to a home use port forwarding approach rather than the rich NAT/PAT capabilities of the UTM9.

Perhaps after a migration tool is available, it will allow us to convert more of our advanced UTM9 configs over and it will make more sense in action.  But from someone that has been configuring firewalls professionally for years, I felt this piece was done incorrectly.  Someone with experience should be able to configure standard NAT/PAT/firewall policies by clicking through the interface.

2. VLANS?  Why can't you provision an interface with VLAN tag without it already being provisioned and IP'd as untagged?  This works well in UTM9 and should be added to Sophos XG.  This forces you to set a bogus IP on the primary interface and tie to zone before you can add tagged interfaces using that hardware.

3. On prem mail server filter?  I couldn't get anywhere with this.  Simple settings like "the ip of your mail server", were nowhere to be found.  UTM9's Mail filter I was able to configure with AD integration and never a look at a manual.  Too simple guys!

What do you think community?  Other comments/input?  Curious to know if I'm alone on some of this.



This thread was automatically locked due to age.
Parents
  • 0
    My thoughts? (not aimed at Adam, but at the Sophos team or whoever it was that bought them out and gutted the product)

    "We at Sophos don't care what you want to do with your router. We want a cloud based solution, where we have all the control. No longer can you fine tune the firewall and web filter, now you have to rely on us knowing what we're doing".

    Seriously, F***K THIS S**T.
    I want to be able to explicitly allow traffic on my network. It's not intuitive at all how to do this. Port Forwarding.... was the goal to make it confusing? And the web filter? What happens when it blocks a site I want accessible, or breaks the site partially. Well, I can completely remove the category, but I can't figure out how to explicity define the site to be ignored. And I sure as hell can't edit the categories at all.


    I understand the desire to make it turn key. But now, I can't do anything outside your narrowly defined box, without resorting to command line. If I wanted that, I would have stuck with pfSense.
    My choices are revert back to Sophos UTM 9.3, or pfSense now. Sure, you didn't lose a paying customer (home use), but you sure as hell have lost an enthusiast that has generated traffic and customers for you.

    Regards
    Drashna Jaelre
    Christopher Courtney.
Reply
  • 0
    My thoughts? (not aimed at Adam, but at the Sophos team or whoever it was that bought them out and gutted the product)

    "We at Sophos don't care what you want to do with your router. We want a cloud based solution, where we have all the control. No longer can you fine tune the firewall and web filter, now you have to rely on us knowing what we're doing".

    Seriously, F***K THIS S**T.
    I want to be able to explicitly allow traffic on my network. It's not intuitive at all how to do this. Port Forwarding.... was the goal to make it confusing? And the web filter? What happens when it blocks a site I want accessible, or breaks the site partially. Well, I can completely remove the category, but I can't figure out how to explicity define the site to be ignored. And I sure as hell can't edit the categories at all.


    I understand the desire to make it turn key. But now, I can't do anything outside your narrowly defined box, without resorting to command line. If I wanted that, I would have stuck with pfSense.
    My choices are revert back to Sophos UTM 9.3, or pfSense now. Sure, you didn't lose a paying customer (home use), but you sure as hell have lost an enthusiast that has generated traffic and customers for you.

    Regards
    Drashna Jaelre
    Christopher Courtney.
Children
  • 0 in reply to ChristopherCourtney
    Hi folks,

    I managed several years cisco routers in order to connect our locations to the internet, meanwhile I have almost a year of experience with SG 230 which connects one of the locations and brings web security to the LAN.
    Now it's time to renew or replace the old cisco routers. My first thought was to use SG UTMs but due to the lack of netflow and not properly implemented ipfix, we had to reconsider this action. Our support partner suggested to try XG UTM because it can export netflow data.
    Well, I spend the whole weekend to get netflow working but I couldn't. All I have seen during that time was far away from a marked ready product. Basically it has nothing to do with all the well known Sophos devices. I see here a complete different/new device, it starts with the, sometimes confusing, interface name, QoS is all down to shaping, I cannot find any queue information which is essentially to see what's going on and take proper action, the log output is a joke.... It feels like an early prototype and I'm not willing nor able to take the risk and connect several locations with a system in this state.
    Additionally I'm a bit confused now, is the XG the road which Sophos follows now, in order to replace the SG series?
Unfiltered HTML