Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 139 replies
  • Answers 4 answers
  • Subscribers 77 subscribers
  • Views 45451 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Firewall: v19.5 MR2: Feedback and experiences

LuCar Toni

Release Post:   Sophos Firewall OS v19.5 MR2 is Now Available  

The old V19.5 MR1 Post: Sophos Firewall: v19.5 MR1: Feedback and experiences 

To make the tracking of issues / feedback easier: Please post a potential Sophos Support Case ID within your initial post, so we can track your feedback/issue. 



This thread was automatically locked due to age.
  • 0 
    Is it in the Sophos roadmap to create exceptions for MFA by zone or IP? Many customers don't like the idea of ​​using MFA on the LAN.
  • 0

    - AIA (Authority Information Access) planned sometimes for Firewall?

  • 0

    Are there reasons MR2 isn't available for deployment through Sophos Central yet?  Only MR1 is presented as a scheduled upgrades option.

  • 0 in reply to onward

    Do you still have a Central Account with a V19.5 MR1 Firewall? 

    __________________________________________________________________________________________________________________

  • +1

     Sophos Firewall: v19.5 MR3: Feedback and experiences V19.5 MR3 was released. 

    __________________________________________________________________________________________________________________

  • 0 in reply to bobbylam

    This doesn't fully answer the question. Attempting to do so with Any as the source for an ACL still displays you cannot. 
    "You can't set the source network to Any when you select HTTPS service and WAN zone. The firewall doesn't allow web admin console access from all WAN sources. "

    I do agree that it is a good thing to have but I would still like to have this as a feature. 

  • 0 in reply to Tony Gaddis

    Hello Tony Gaddis,

    Please go through release notes where it's mentioned that HTTPS access would require specific source to be selected. It won't work with "Any" source -  Sophos Firewall OS v19.5 MR2 is Now Available .

    Web Admin access for specific IPs:

    • We strongly recommend disabling web admin console access from all WAN sources (the Internet) to reduce the potential for a brute force or reconnaissance attack. Instead, we suggest that remote management of your firewalls be performed through Sophos Central which is free for all customers.
    • However, if you absolutely need to provide WAN access to the web admin console, v19.5 MR2 enforces WAN access from specific IP addresses and networks using an ACL exception rule (Administration > Device access > Local service ACL exception rule). It will no longer be possible to enable web admin console access from all WAN sources.

    Regards,

    Sanket Shah

    Director, Software Development, Sophos Firewall

  • 0 in reply to Tony Gaddis

    You can use Internetv4 with all IPs in the Internet, if you want to go down that road. 

    __________________________________________________________________________________________________________________

  • 0

    Since we were on 19.5 MR2 we noticed, HA A/P switch to the Auxiliary Node downtimes massively decreased. I do not find information in the release notes nor fixed issues. But with earlier versions we had LAN communication loss of 5-10 minutes and WAN connectivity loss of 10-15 minutes after we switched the active node.

    Since MR2 the connectivity loss reduced to 2-4 pings lost.

    Now even after we moved from MR2 to MR3 already this still remains.

Unfiltered HTML