Sophos UTM: Decommissioning of obsolete URL categorization services CFFS.Click here for important info.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 242 replies
  • Answers 6 answers
  • Subscribers 74 subscribers
  • Views 43728 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Firewall: v19.0 MR1: Feedback and experiences

LuCar Toni

Re-Release: https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-firewall-v19-mr1-re_2d00_release-build-365-is-now-available

https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-firewall-v19-mr1-is-now-available

Release Notes: https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_190_rn.html

"Old" V18.5 MR4 Thread: https://community.sophos.com/sophos-xg-firewall/f/discussions/134965/sophos-firewall-v18-5-mr4-feedback-and-experiences

V19.0 GA Thread: https://community.sophos.com/sophos-xg-firewall/f/discussions/134009/sophos-firewall-v19-0-ga-feedback-and-experiences



This thread was automatically locked due to age.
Parents
  • 0

    I have a problem with firewall rules. Since I upgraded from 19.0 GA to 19.0 MR1, my WIFI rule is not working anymore, nothing is let through. No ping, no TCP connection from LAN zone to WIFI zone:

    As you can see, 0 bytes sent/received. When I switch back to 19.0 GA it all works again and counters go up. I have no explanation why this is happening, any idea where to look for in the logs?

    Edit: Same seems to be the case for Rule #11 SMTP.

  • 0 in reply to EdmundSackbauer

    Same problem observed. After the upgrade to v19.0.1 MR-1 traffic is not hitting the firewall rule and is being logged and dropped by rule ID=0.

Reply Children
  • 0 in reply to MarekDalke

    Could you send me the AccessID as well? 

    __________________________________________________________________________________________________________________

  • 0 in reply to MarekDalke

    Coming back to this one: &  

    This seems to be an already under investigation issue with the wlnet (separate Zone) based traffic. 

    Bug ID: NC-94019

    Currently under investigation. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    One workaround in a broader Scale would be using Central Wireless + VLAN Tagging, if applicable. 

    Just wanted to share this workaround / alternative deployment method. (That is the reason, i did not pick up this issue, as i do not use any separate zone anymore and moved everything to VLAN). 

    Central Wireless is free to use.

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    We are also facing issue of with wireless separate guest  network . I have deleted  guest  zone and recreated it ,then added to acces point group again then only it works......

  • 0 in reply to MarekDalke

    Temporary workaround provided by Support Engineer which I believe I can share here.

    You need to modify the timer value in /sys/class/net/<affected_interface_name>/bridge/ageing_time from 0 to 30000. In my case:

    # echo 30000 > /sys/class/net/wlnet3/bridge/ageing_time

    After above modification traffic started to hit the firewall rule as before the upgrade to v19.0.1 MR-1.

  • 0 in reply to LuCar Toni

    I can confirm LuCarToni's workaround. I had the same problem after upgrading from 18.5.2 to 19.0.1.
    I put the access points (without Central Wireless) into several VLANs and so far I have no more problems. It is of course a little effort to provide the active components (switches) with the VLANs, but are with us and our customers all managed switches Relaxed
    And I have also gained more flexibility, because I can now determine exactly in which directions the data traffic between the WLANs and the LANs should run.

    Best regards

    Michael

  • 0 in reply to LuCar Toni

    This is pretty much what I did when I switched to Central Wireless. I substituted VLANs for the VXLANs that XG-based wireless used. I don't use the WiFi zone anymore, but instead it's three zones corresponding to three AP-based VLANs: LAN, Guest, and Work_IoT. (Actually, LAN is a bridge between an AP-based VLAN and a wired port for a server.)

    Works great.

Unfiltered HTML