Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 76 replies
  • Answers 6 answers
  • Subscribers 62 subscribers
  • Views 29514 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Firewall: v19.5 MR3: Feedback and experiences

LuCar Toni

Release Post:  Sophos Firewall OS v19.5 MR3 is Now Available  

The old V19.5 MR2 Post:  Sophos Firewall: v19.5 MR2: Feedback and experiences  

To make the tracking of issues / feedback easier: Please post a potential Sophos Support Case ID within your initial post, so we can track your feedback/issue. 

Release Notes: https://docs.sophos.com/releasenotes/index.html?productGroupID=nsg&productID=xg&versionID=19.5 



This thread was automatically locked due to age.
  • 0 in reply to jekin.virparia

    Hi,

    I cannot remember seeing RADVD requiring a manual restart in any recent updates or XG restarts. I restarted RADVD from the GUI without any issues.

    Ian

    XG115W - v20.0.3 MR-3 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    We have found two legacy issues on your setup 

    1) UI AP status reflects after reboot in case of LocalWifi (being tracked via NC-123230)

    2) External APX not coming online (when rebooted device after disabling wireless protection) - 

    To fix 2nd issue - you would need to Enable wireless protection and reboot device again - this issue is being tracked via NC-123249)

    We believe mentioned workaround should fix APX120. 

  • 0 in reply to SPandya

    Hi,

    thank you for the update.

    I will restart the XG in the morning.

    Ian

    XG115W - v20.0.3 MR-3 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to SPandya

    Hi,

    the APX120 is back online after an XG restart. How do I disable the local (inbuilt) AP?

    Ian

    XG115W - v20.0.3 MR-3 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0

    I'm seeing SSL-VPN Connections not being accepted after Upgrade from MR2 in my demo-lab (sfos-home).
    SSL-VPN is enabled on WAN-Zone but no connection successful. Device Access ACL seems to block but i can't tell why as settings are fine.

    drppkt on advanced shell showing "log_type=Firewall log_component=Local_ACLs log_subtype=Denied"

    2023-08-07 11:38:12 0103021 IP 192.168.222.124.56969 > 172.16.2.80.443 : proto UDP: packet len: 22 checksum : 36453
0x0000:  4500 002a c861 0000 7f11 25dc c0a8 de7c  E..*.a....%....|
0x0010:  ac10 0250 de89 01bb 0016 8e65 38ff 066e  ...P.......e8..n
0x0020:  02f1 0333 fe00 0000 0000                 ...3......

Date=2023-08-07 Time=11:38:12 log_id=0103021 log_type=Firewall log_component=Local_ACLs log_subtype=Denied log_status=N/A log_priority=Alert duration=N/A in_dev=Port2 out_dev= inzone_id=2 outzone_id=4 source_mac=c8:4f:86:fc:00:05 dest_mac=00:1a:8c:44:00:45 bridge_name= l3_protocol=IPv4 source_ip=192.168.222.124 dest_ip=172.16.2.80 l4_protocol=UDP source_port=56969 dest_port=443 fw_rule_id=N/A policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x8001 nfqueue=0 gateway_offset=0 connid=2322130158 masterid=0 status=256 state=0, flag0=824635817984 flags1=17179869184 pbrid[0]=0 pbrid[1]=0 profileid[0]=0 profileid[1]=0

    ACL is fine:

  • 0 in reply to FFin

    Did this configuration work in V19.5 MR2? 

    Do you have a WAF configured? 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    yes, I'm quite sure - and no waf-rules, no dnat active.
    You're asking because of 443 udp?

  • 0 in reply to FFin

    Check the sslvpn.log on CLI for more insights. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    No connections at all - i think traffic is not getting forewarded to ssl-vpn, as visible in drppkt?

  • 0 in reply to FFin

    I have DM you for support access.

Unfiltered HTML