Firmware and SCFM

Hey,

SCFM should use the same release like SFM. Did you have a look at this thread:

https://community.sophos.com/products/xg-firewall/f/sophos-firewall-manager/81494/sfm-for-v16-release-date

v15 should be able to manage XG v16 version with the proper compatibility update.

Let us know.

Thanks

Hi,

Got in touch with support and was told that without downgrading XG to v15m3 I wont be able to sync XG with scfm.

So I decided to wait till SCFM will get an update (Which is due in near future).

Regards

Ray

Hi Ray,

SCFM team has released the compatibility for below SFOS v16 firmware in SCFM v15.

SFOS 16.01.1 (Build 202)

SFOS 16.01.2 (Build 222)

User is able to manage and sync XG v16 above version with SCFM. User can push SFOS V16 new feature configuration through SCFMv15 from device level only. User is not able to push configuration of new feature of SFOS v16 though SFM/CFMv15 from Group level.

Ravi Patel

Hi RaviPatel,

I am experiencing sync issues with my xg105w running v16.01.2.

Basically my XG will show in SCFM as connected but is unsynchronised.

I can't push policies to this device or see existing ones from SCFM.

Was told by Support I need to Downgrade to v15-mr3.

I was unable to find KB article on compatibility.

Could you provide a link please.

Hi Ray,

Please provide below detail to analyze your issue further.

1. SFOS Admin Console HTTPS Port value (System --> Administration --> Setting Page)

2. SFOS Central management page screenshot (System > Administration > Central Management)

3. Access port value for SFOS device in SCFM (System Management > Device Settings > Managed Devices > Devices)

Ravi Patel

Hey,

HTTPS Port values.

Central management

Access port value

Hi Ray,

I have word with CFM team and found you have configured the CFM domain name in SFOS IP detail. Please login to SCFM, go to System Management > Device Settings > Managed Devices > Devices page and click on edit device. Check the ip address detail, it was us-e1.cfm.sophos.com. Change it to your SFOS live IP, then check the Test connection is successful or not.

If Test connection is successful then your device will get sync in 5-7 minutes.If it was unsuccessful then there is communication issue between your SFOS device and SCFM.

Ravi

Hi Ray,

I have word with CFM team and found you have configured the CFM domain name in SFOS IP detail. Please login to SCFM, go to System Management > Device Settings > Managed Devices > Devices page and click on edit device. Check the ip address detail, it was us-e1.cfm.sophos.com. Change it to your SFOS live IP, then check the Test connection is successful or not.

If Test connection is successful then your device will get sync in 5-7 minutes.If it was unsuccessful then there is communication issue between your SFOS device and SCFM.

Ravi

Hi Ravi,

[UPDATE]

Im getting this notification when passing in Public IP

I'm getting connection Timeout when doing connection test.

Just to clarify the admin username and password is for XG Firewall. (for example admin/admin)?

Regards

Raimonds

Hi Ray,

Yes, you have to enter your SFOS admin credential in SCFM edit device page.

Ravi

Hi Ravi,

After passing in Public Ip im getting this notification.

The new settings have been saved but test fails. [Connection timeout]

Regards

Raimonds

Hi Ray,

As per your screenshot, there is connectivity issue for port 4444 between SCFM and your XG device. Have you created firewall policy in XG device for 4444? Are you able to access your XG device using XG public IP on port 4444?

https://XGpublicip:4444

Ravi

Hi Ravi,

I have default policy on XG.

I will try to access XG with https://publicip:4444 later on and let you know.

Regards

Raimonds

Hi Ravi,

I'm not able to get into https://publicip:4444

getting this

[EDIT]

Had to add Device Access settings -> HTTPS.. and it works fine.

Still doesn't sync tho.

Hi Ray,

From CFM, we are still getting connection time out error for your SF device.

 curl -k https://93.107.173.150:4444

 curl: (7) Failed to connect to 93.             port 4444: Connection timed out

Please email me(ravi.b.patel@sophos.com) your SF device admin login credential, public IP with GUI and SSH access to check issue further.

Ravi