Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Replies 170 replies
  • Subscribers 33 subscribers
  • Views 34177 views
  • Users 0 members are here
Options
Suggested

Restricted Advance Shell - examples of challenges

PMParth

Hi Community contributors,

Starting Sophos Firewall v19, with the addition of many comprehensive logging enhancements in the GUI, and in-line with industry best-practices, access to the Advance Shell is restricted to licensed commercial versions of the product.

Partners and certified architect engineers have an option with Not-for-Resale license to set up labs or customer PoC with unrestricted advanced shell. Also, Sophos Support is able access the Advanced Shell via support access channel. Hence, in case of critical issues, support can still can access it.

Sophos Firewall has been incrementally improved since v18 with comprehensive logging enhancements in the GUI (Better search, filtering, configurations, SD-WAN logs, VPN logs, gateway logs etc). However, we acknowledge that Advance Shell restriction might have created challenges in certain database related configurations, especially for home users.

Please help us understand the specific examples of challenges you face due to this restriction - configurations where GUI and console tools are reaching the limits. We will suggest the possible workaround for the specific scenario. We will also plan and gradually improve the product for those scenario.

Sincerely,

Sophos Firewall Product Team

Parents
  • 0

    Ok, this is not a good sign for me.

    My use cases for the advanced shell (commercial and home edition) are the following:

    - filter logs

    - acess the databases with scripts for searching policies and reporting

    - get the WAF config via shell

    - check_mk monitoring the entire system (yes, i know this is official not supported) 

    - Troubleshooting the entire system to often….

    Sophos, serious?? No matter, which edition of the XG firewall without full shell access is not a good idea. The problems are starting with the system logs, waf logs, firewall logs,… 

    Logging at the XG GUI is horrorful, the only way you can find problems, or config issues is to search the logs on the command line with good onboard linux tools like tail, grep, less, awk,… 

    Also accessing the database and do advanced config searching is only possible in the full shell…

    What is the reason to hide the advanced shell in free versions only? I can`t get it.

    It looks like, that my migration path also in the home office is pointing in direction unify, or palo alto, i know, these are payed versions only, but they are working very good.

    This makes me really sad…

Reply
  • 0

    Ok, this is not a good sign for me.

    My use cases for the advanced shell (commercial and home edition) are the following:

    - filter logs

    - acess the databases with scripts for searching policies and reporting

    - get the WAF config via shell

    - check_mk monitoring the entire system (yes, i know this is official not supported) 

    - Troubleshooting the entire system to often….

    Sophos, serious?? No matter, which edition of the XG firewall without full shell access is not a good idea. The problems are starting with the system logs, waf logs, firewall logs,… 

    Logging at the XG GUI is horrorful, the only way you can find problems, or config issues is to search the logs on the command line with good onboard linux tools like tail, grep, less, awk,… 

    Also accessing the database and do advanced config searching is only possible in the full shell…

    What is the reason to hide the advanced shell in free versions only? I can`t get it.

    It looks like, that my migration path also in the home office is pointing in direction unify, or palo alto, i know, these are payed versions only, but they are working very good.

    This makes me really sad…

Children
No Data
Unfiltered HTML