Sophos Firewall: v20.0 GA: Feedback and experiences

Can you explain - what your concerns are here? 
So if you are setting up the firewall, in a "pre registrations state" the firewall allows everything to the internet. That is to allow an administrator to setup the firewall and still have access to tools like a password safe etc. But this state should not be the usual case of a firewall. 

And there should be no difference between V20 and V19.5. It has the same behavior pre registration. 

The Default TLS inspection rule is setup to "No do anything" for the domains, you add to the list and are added by Sophos to the list. If you do not create a own list, it will not do anything. 

About TLS Inspection: There are two different modules working here: 1. Inspection by decryption & 2. blocking of ciphers / methods you dont want to have. They can work independently. So you can block for example RC4 but not decrypt the traffic. 

And if you find a website not working with blocking of insecure cipher, you can build an exclusion. But that is nothing, SFOS "related". 

Interesting, but strange answer.

A post from another forum I visit advises that ASUS router/firewall and PFSense also have the same startup issue with open internet access for a few seconds.

Ian

No response after chasing this up, am I to just accept that I no longer have any reporting functions?

 Hi CraigLloyd 

Upon investigating the issue with your device, we discovered that the /var partition is currently 84% utilized. According to the established logic, report summarization is halted when the /var partition reaches 80% & more. To address this, we propose conducting a cleanup of old data. If you agree, we can schedule a live session to perform the cleanup activity. By removing old data and reducing the /var usage below 80%, you should then be able to view the reports and graphs. Please confirm your availability for a live session.

Yes, I'm available for a live session, what do I need to do?

I can't reply to your PM but the time you suggested it ok for me

Hi CraigLloyd , I have shared the meeting invite in PM

In the release notes it was mentioned, that Heartbeat false positives have been reduced: "Synchronized Security has also been enhanced with added scalability and reduced false missing heartbeats for devices that are in a sleep or hibernate state."

After upgrading to SFOS 20 we still see the same amount of false positives concerning "missing hearbeat" alerts as with v19.x before.

Can anyone confirm that in v20 anything has changed here to the better and what one can do to improve the situation? Our workaround currently is to avoid S0 (modern standby) as much as possible, but this is not a very convenient solution and is not applicable to every device (MacOS for example).

Thanks for any comments.

Hans

Hi Hans,

Thanks for your post.

To avoid false missing heartbeat alerts due to modern standby, changes are needed on both SFOS and Endpoint.
SFOS 20.0 has these changes. Similarly Windows Endpoint also made the necessary changes and are available to customers with latest version, which is being rolled out.
MacOS Endpoint changes are in pipeline and will be available in future.

Hope this answers your query.

Thanks,
Vamsee

Hi Vamsee,

thanks a lot for your prompt reply!

Can you specify which Endpoint version it needs to get the changes that you mention?

All our Windows clients currently run

Is there anything newer out yet?

Best,

Hans