Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 44 replies
  • Subscribers 50 subscribers
  • Views 14880 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Firewall: v18.5 MR4: Feedback and experiences

LuCar Toni

https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-firewall-v18-5-mr4-is-now-available

Release Notes: https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_185_rn.html

Old V18.5 MR3 Thread: https://community.sophos.com/sophos-xg-firewall/f/discussions/133547/sophos-firewall-v18-5-mr3-feedback-and-experiences



This thread was automatically locked due to age.
Parents
  • 0

    All Central managed Accesspoints are showing as offline after MR3 to MR4 upgrade.

    Logfile shows, they are running and still communicating with Central Domains, no blocks. But byte sent: 0 in webfilter log - so there is some communication issue.

    APX320, APX530 APX320X

    APs are in a VLAN, bound to / routed by XGS.

  • 0 in reply to LHerzog

    Try: community.sophos.com/.../troubleshoot-a-broken-application-in-sfos

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Thanks for your post and writing that linked article! Will go through that.

    I just found PolicyID 3 is the manual drop+log rule. Showing as green. I don't mind, that is a long known issue.

    I doublechecked the correct fw rule for the accesspoints uses the correct hosts, ports and zones exists and matches. it does. re-saving the skipped firewall rule does not help so far.

    will report back.

  • 0 in reply to LHerzog

    It was XGS's wildcard DNS name resolution issue. We allow:

    that *.prod.hydra.sophos.com resolves correctly.

    That's a screenshot of the IPs resolved to the wildcard FQDN host:

    But the firewall rulehas not been hit by the traffic, it ran through the rule set until the block+log rule.

    So I created a new FQDN host for the full FQDN wifi-cloudstation-eu-central-1.prod.hydra.sophos.com, no wildcard

    We can see the same IPs in that new created object.

    Added it to the firewall rule above and only seconds after saving the rule, the APs showed online in central.

    Central:

    So SFOS has issues with wildcard FQDN of Sophos.

  • 0 in reply to LHerzog

    Updated our main XG430 from MR3 to MR4.

    There we have the same issue with two central managed AP320X.

    wifi-cloudstation-eu-central-1.prod.hydra.sophos.com/

    is not reachable although we have configured access to *.prod.hydra.sophos.com in a firewall rule. Traffic runs through the ruleset and finally hits our drop rule.

    APs were online for about 45minutes after the upgrade but then went offline and we could notice the same issue in log viewer ->  webfilter.

    Policy 5 is our block+log rule.

    Can Sophos explain what is happening here, please?

Reply
  • 0 in reply to LHerzog

    Updated our main XG430 from MR3 to MR4.

    There we have the same issue with two central managed AP320X.

    wifi-cloudstation-eu-central-1.prod.hydra.sophos.com/

    is not reachable although we have configured access to *.prod.hydra.sophos.com in a firewall rule. Traffic runs through the ruleset and finally hits our drop rule.

    APs were online for about 45minutes after the upgrade but then went offline and we could notice the same issue in log viewer ->  webfilter.

    Policy 5 is our block+log rule.

    Can Sophos explain what is happening here, please?

Children
No Data
Unfiltered HTML