Sophos Firewall: v20.0 MR1: Feedback and experiences

I am sorry, but you can. Login via SSH to the Primary. Which works fine in your example. Then on the primary, you can use ssh admin@HAClusterIP to login to the second appliance.

From there, we can discuss and investigate, why we cannot reach the AUX. Because there we could try to find the reason in tcpdump, why your network is not able to access.

Another thought here: Maybe it is easier, if you could through a network flow (even in paint) where it fails and how you could find the management port be involved. Pictures make it easier to understand. 

Looking into your network flow: From what i understand, you have the .1 (a router). You are in this network, the firewall is .2 and .3 
So why are you going from the client with IP .100 to the firewall, then to .1 in the same network? How is the firewall even a part in your setup, if your gateway is the network? 

Hi Nikhil,

we are facing the same issue, can you please send me the comman to delete the stale entries?

BR Gerd

We face the issue that we are multiple admins using different machines. So we loose much time logging out and in again just to get an understandable GUI. I guess there woudn't be so much complains about this "Feature" if the German translation had a usable quality. The Translation is so bad that sometime it's almost not understandable.

If you want, you can sum up some of those not understandable translations.

Because as a German, i went through the German Webadmin and could understand most points. 

Feel free to create a new thread with examples and we can address them. 

I have an issue, after updating my firewall at home to v20.0MR1 last night all my IPSEC-VPN connections (all route-based and 4 in total) are failing. Got an error something like remote side does not respond (or very similar).

Tried to recreate 1 tunnel to one of the firewalls (using same settings) but this did also not come online.

All tunnels are configured to other Sophos firewalls

• 1 is at v20.0.0 GA
• 2 are at v19.5.3 MR-3
• 1 is at v19.5.2 MR-2

Since it was really late and I desperately needed to go to bed, I just rolled back to v20.0.0 after which all 4 connections came back online.

I'm not sure if anything has changed in policies (all connections are using the IKEv2 profile).

Just noticed this morning that SSO to this firewall is not working anymore whereas credential login does work. SSO will always get to a page

Firewall is starting

Please stand by while the system finishes loading.
Firewall management and security services will be available shortly.
You will be redirected to the login screen, once startup is complete.

Main question tough is about the RB-VPN connections to the 4 other firewalls of which none comes back online after upgrading. Hopefully someone has a clue in what could be the issue.

Please share access-ID in PM

Hi apijnappels , regarding the IPsec VPN issue, please share below details:

* Logs (from cli - /log/charon.log) on far end SFOS while the connection is attempted on SFOS that is migrated to v20.0.MR1

* IPsec related configurations on both SFOS nodes.

* Also, please verify the SFOS that is migrated to v20.0.MR1, IPsec flag (ACL) is set (turned ON) on WAN zone for IPsec (this is a new setting in v20.0.MR1); you can verify it from from the UI - Administration --> Device Access;

• Hi just checked /log/charon.log on the far end and there doesn't seem to arrive any new logging since I upgraded back to MR1 some 20 minutes ago. In the same logfile other VPN-connections are logging additional lines.
  charon.log on upgraded firewall shows the following:
  
• IPsec flag is (and was already) turned ON on WAN zone.
  
• Both locations use the IKEv2 profile which I checked to be identical. It's all route-based setup using RSA-keys as authentication type

We have not seen any such issue (verified rbvpn tunnel with RSA between v20.0.MR1 and v20.0.GA)

When the upgraded SFOS (to v20.0.MR1) attempts IPsec connection (assuming this is the Initiator), on the other SFOS (assuming Responder running v20.0.GA), please check fes things mentioned below in the CLI of responder SFOS and provide the output:

a) tcpdump -n port 500 or 4500    // this will tell if the IKE packets reaching responder SFOS or not.

b) if you see packets reaching responder SFOS, please also do

     tcpdump -nv port 500 or 4500    // wanted to check the packet length.

c) if no IPsec/IKE packets are seen on responder node, please check if there are any drop packets

drppkt | grep 500 (this will check if there is any incoming IKE packet is dropped).

You may want to DM the details to me if it is appropriate.

DM sent with output