Update: V21.0 supports Lets Encrypt onboard:  Sophos Firewall v21 Early Access Announcement  

FINALLY!!!!!!

Now we need the time server back....

What kind of use case would you resolve with an NTP Server in SFOS? 

Just wondering, as i am implementing everything with a simple NAT rule and no changes are required in the deployments. 

There are certain devices I don't want to get out to the internet for any reason (think chinese cameras).  But they need to be sync'd to the same time source for chain of custody reasons. 
I'm currently running a separate time server but I'd rather have it on the FW like the old UTM.
Unless someone can sight a best practice to the contrary?

It is fw job to allow chinese camera only to have access to external ntp source. Less roles is more secure.

Hi,

Sorry, but before you introduce NTP you should first implement the mail functions for quarantine properly.

I can't understand at all how you can't simply send quarantine reports like other manufacturers when a mail ends up in quarantine. This is only possible if the person also has an account. This may work with 5 people but not with 50 or 100 who are not automatically loaded via AD by SFOS.

In the UTM this was simply even automatic, now you need everything extra at SFOS via account for collective mailbox group mail addresses.

Hi,

Sorry, but before you introduce NTP you should first implement the mail functions for quarantine properly.

I can't understand at all how you can't simply send quarantine reports like other manufacturers when a mail ends up in quarantine. This is only possible if the person also has an account. This may work with 5 people but not with 50 or 100 who are not automatically loaded via AD by SFOS.

In the UTM this was simply even automatic, now you need everything extra at SFOS via account for collective mailbox group mail addresses.

Did you had a chance to look into Central Email, which brings all those features (plus additional features as well)? 

UTM customers nowadays are advised to migrate to CEMA (Central Email) instead of using the Email Protection of the firewall.

Email Protection works pretty well I must admit. But its kind of annoying for my team to find reasons for undelivered mail as it is only visible as a tooltip. The use of rbl is very effective and made reports almost obsolet. 

Glad LE finally made it to SFOS. 

Still missing sophos otp for webserver protection though. :(

You could just say, our MTA implementation is crap - and we don't have plans to fix that -> use the cloud product instead.
or move on to solutions that don't get crippled by their successor products.

Currently, all of my customers, when they get to choose between UTM and CEMA, they would go with CEMA all the way, as it is the full fetched email product, coming from the Sophos Email Appliance, which was always the primary Email product of Sophos. 

Nowadays, as Sophos split up the email subscription into an own subscription, everybody can decide what to do with their email product and you are not locked into a bundle. 

The promos of Sophos also include CEMA and not Email on the Firewall. 

The Email protection of Sophos works as it is - and it does it job of scanning and filtering emails. Bugs are getting addressed and fixed as well.

If a customer has certain requirements, you can always interact with Sophos or the Sophos partner to validate the options like moving to CEMA or interacting with another product. 

might be a bit off-topic to continue with MTA in this topic...

but moving to a cloud-based mail security solution when your emails are already in the cloud (e.g., EXO) makes (some) sense. However, relying on a cloud service to filter emails when you intentionally keep your mail servers on-premises to avoid data being on 'someone else's computer' (aka the cloud) is not just ironic—it's counterproductive and undermines the very reason for keeping things in-house. I'll keep the discussion about the Central Mail Product off this Thread.