Fireware Update

Question

Hi TEam, 
 
 Can you please suggest here, 
 1.How to check the existing running version in XG firewall?(Steps) 
 2.What is the downtime required if this is the older one ? 
 3. What is the impact of up gradation in existing policies or client affect?

Vishal_R · Accepted Answer

Hi paresh palav Please find the requested information below: 1.How to check the existing running version in XG firewall?(Steps) 
 Answer : Multiple method to confirm the existing firmware. 
 1)Login on XG Firewall and check the version on Dashboard. 
 2) Login on firewall and Navigate --> System --> Backup & Firmware --> Firmware 
 Here you may check the active firmware. 
 2.What is the downtime required if this is the older one ? No fix down time but generally upgrade procedure will take approx 30-40 min if you are having single device. If you are having HA setup you may upgrade with zero down time. Upgrade Firmware KBA : https://community.sophos.com/kb/en-us/123285 P lease take a backup of current configuration as in safety measure. 
 https://community.sophos.com/kb/en-us/123145 ( After upgrade restore of backup not required as it will migrate all existing settings and configuration). 
 3. What is the impact of up gradation in existing policies or client affect? No any impact as existing settings will be migrated to upgraded version. The latest version contains some of the fix of ongoing issues reported in previous version.Please refer release note for more information on fixed issue details. https://community.sophos.com/products/xg-firewall/b/blog/posts/sfos-17-5-mr9-released

Clark Baird · Answer

I just got off with Sophos support, it affects ALL versions of Sophos XG firmware except 17.5.9 MR9. There is no way to force a hotfix update, it's likely a rolling patch/push. 
 No info on what the vulnerability is, Support seems caught as unaware as we are and recommended upgrading production firewalls to v17.5.9 to mitigate the issue (in the middle of the day?!?!?).

Jeremy Parr · Answer

New firmware isn't typically released for the XG to update to via the GUI. You can download from the MySophos portal.

AWilson · Answer

go here : https://secure2.sophos.com/en-us/mysophos/my-account/network-protection/firmware-updates.aspx 
 log in 
 enter S/N of unit 
 grab updated FW 
 profit.

Clark Baird · Answer

Unconfirmed though official channels but unofficially it looks like the issue is related to SSH access from the WAN. If you turn off SSH access from the WAN (which you should anyway!) then it should mitigate the vulnerability. For reference, best practice is to turn off WAN access to the admin portal, SSH and/or any items you don't actively need (SSL VPN or User Portal asside). If you absolutely need access, try to lock it down to a specific ACL. 
 That said, still update your firmware or watch for the hotfix to be applied. The above will help mitigate, but is NOT a fix.