Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Sophos Firewall: v20.0 MR1: Feedback and experiences

Release Post:  Sophos Firewall OS v20 MR1 is Now Available 

The old V20.0 GA Post:  Sophos Firewall: v20.0 GA: Feedback and experiences  

To make the tracking of issues / feedback easier: Please post a potential Sophos Support Case ID within your initial post, so we can track your feedback/issue. 

Release Notes: 

Important Note on EOL Sophos RED Support:

The legacy EOL RED 15, RED 15w, and RED 50 are not supported in v20 MR1. Customers using these devices should upgrade to SD-RED or a smaller XGS appliance before upgrading to MR1 to maintain connectivity. See the following article for details: Sophos RED: End-of-life of RED 15/15(w) and RED 50

[bearbeitet von: LuCar Toni um 10:50 AM (GMT -7) am 16 May 2024]
  • Problem with dhcpd after MR1 upgrade

    Hi LuCar,
    after upgrading to mr1 the dhcpd doesn't start anymore.
    The dhcpd.log file states a problem with "nextserver".
    We're opening a supportcall and will downgrade to 20.0.0 to have a working system

    That happened on another system too.


    Olaf Pelzer

  • Thank you    for reporting this.

    We have identified the root cause, workaround, and resolution.

    Root cause summary:  

    DHCP Boot Options Next-server configuration cannot take URL value (as per RFC 2131). The validation for the URL is missing in v20 MR1. When URL is present in DHCP Boot Options Next-server config, the DHCP service fails to start.

     Workaround: Please remove URL config from the DHCP Boot Option Next server configuration (DHCP server  > Boot Options > Next-server).

    Resolution:  We will soon release a hotfix to resolve this/prevent it from happening. And also fix this in the immediate next maintenance release.

    Root cause details:  

    Till 20.0 GA and earlier versions, Boot Option configures DHCP options 66 and 67 internally and did NOT consider Next-server and boot file configurations.

    In 20.0 MR1 and later versions, these settings configure the DHCP Boot Options Next-server and Boot file option available in the DHPC header. 

    During Migration, if DHCP Boot options Next-server and Bootfile are configured, then when migrating to 20 MR1, SFOS retained the configuration for both DHCP Boot options (Next-server and Boot file) and DHCP options 66 and 67. Additionally, DHCP options 66 and 67 was populated by the firewall (internally) will be made visible on UI under the DHCP option section.

    The next-server option only support IP address and domain. URL values are not supported (as per RFC 2131), however, the URL value validation has been missing which caused the DHCP service to fail.

    Thank you for your understanding and patience as we work to resolve this issue.  

    Sophos Team

  • what exactly do you mean with URL? did the customer enter a FQDN or a http/file link?

    FQDN should be supported

Reply Children