Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Firewall: v19.5 GA: Feedback and experiences

Release Post:  Sophos Firewall v19.5 is Now Available 

Old v19.0 MR1 thread:  Sophos Firewall: v19.0 MR1: Feedback and experiences 

EAP Sub thread:  SFOS v19.5 Early Access Program (Read Only) 

EAP 19.5 Thread:  Sophos Firewall: v19.5 EAP1: Feedback and experiences 

This thread was automatically locked due to age.
Parents Reply Children
  •   Dev team would like to investigate why BGP is not working in your setup.Can you share the support access for your device/s in  Private message to me? Meanwhile some quick info on this setup will help us - Is this migration or fresh install for 19.5 GA? What is the remote end /neighour device for BGP.   The devices provide us 1. config from /conf/routing/ 2. Logs: /log/csc.log , /log/bgpd.log , /log/zebra.log 

  • We had a major problem with bgp. Had to roll back. Will post more tomorrow 

  •  Like wise Dev team would like to investigate this setup too. Can you share access details and info as above for your installation in private message to me.

  •    in addition to above, if we can get full backup and complete logs from /log that will help.

  • **We are currently investigating the problematic scenario/use case under NC-109623 as we have not faced such issue internally during our testing.

     We worked with Jaroslav Faldik and able to resolve the problem with additional configuration of “no bgp network import-check”.  This will help overcome extra validation performed by the BGP service before advertising network that specific network should be available in RIB before advertising to peer.


    BGP Network Configuration:


    address-family ipv4 unicast


       maximum-paths 15



    How to check if specific network is advertised to peer? 

    bgp# sh ip bgp

    BGP routing table entry for, version 18

    Paths: (1 available, no best path)

      Not advertised to any peer

      Local (inaccessible) from (

          Origin IGP, metric 0, weight 32768, invalid, sourced, local

          Last update: Fri Nov 18 09:06:38 2022

    Basically, when you are seeing configured BGP network is not getting advertised to any peer, which stopped working after migration/upgrade to v19.5:

    1. Interface link is down where this subnet is configured. 
    2. Interface subnet mismatch compared to network configured in BGP e.g., in case interface subnet is “”, and configured network is “”.

    One can try the additional CLI command no bgp network import-check” in BGP to overcome these validations.

  • We had some downtime so we jumped back to 19.5 if you want to jump in firsthand and see the issues.

    Hey Guys,  and I re-upgraded to 19.5 so we could do some testing and appy the above command. When we have all 4 tunnels up, the intended subnet doesn't get advertised to the expected peers. So we did the "no bgp network import-check", but it didn't resolve the issue. When we down one of the tunnels, I can see that the subnets then get advertised to the other tunnel that shares a peer with the tunnel that was shut down.

    Any additional tests we could perform?

  •  did you come up with a solution? How many routes do you accept? We take full tables from 3 providers (2.8 mil routes or so) and V19.5 falls on it's face. V18.5 handles it ok, but not in HA failover. The router process shoots up to 100% CPU and the firewall locks up. V19.5 on a single unit is very sluggish and the network traffic latency is affected. This is an XG330, so there should be no issues. We don't use XG as an edge device, since I know it can't handle it, but Sophos says it can, so I test it on every release.

  • Hi  , is it possible to share support access id for your device running 19.5.?Dev team would like to investigate what causes the device become slow or the cpu utilisation difference between 18.5 and this version. please PM me. -Shrikant