9.604 without problems?

Hello

we have 2 Firewalls in HA. May I update both direct from Web Intrface? We have 6 RED 50 too outside.

May be Problems with the updates?

THX

peter

Hallo Peter and welcome to the UTM Community!

UPDATE 2019-07-31: See my latest post below.

First, read the threads above.  I'm getting ready to handle a similar situation with a client.  Here's a copy of the plan I proposed:

1. Disable the RED Servers in WebAdmin.
2. Start the Up2Date process and wait for it to complete - probably about 10 minutes or so.  Watch on the High Availability 'Status' tab for the new Slave to be READY.
3. At the command line, disable the use of unified wireless firmware.
4. Enable the RED Servers in WebAdmin.

The only disruption would be to an upload or download or VoIP call active at the moment the current Slave becomes the Master node.

Cheers - Bob

https://community.sophos.com/products/unified-threat-management/b/utm-blog/posts/utm-up2date-9-605-released

9.605 has fixes apparently but according to the post in the below link  its all a bit convoluted ,  "disable the network behind the red before updating:......"  

https://community.sophos.com/products/unified-threat-management/f/remote-ethernet-device-red/111304/utm-9-601---red-issues#pi2353=4

Re: 9.605 Up2Date

How does a bricked RED50 look like?

Like this?

2019-08-06 See my final version posted today.

UPDATED 2019-08-01

Hi All,

I've had several messages back and forth with Sophos folks.  As Jan Weber says in a post, 9.605 fixes the problem with REDs and the only danger is updating the RED firmware when the RED is under a heavy load.  I have suggested that the following instructions be added to the information about the Up2Date (I in blue dot) and the blog post about the 9.605 Up2Date:

In order to ensure that there's no problem with the update of firmware in RED devices, do the following with two planned outages:

 1. Outage 1 - Up2Date to 9.604:
     A. In WebAdmin, disable all RED Servers for RED appliances.
     B. Apply Up2Dates through 9.604.
     C. At the command line: cc set red use_unified_firmware 0
     D. In WebAdmin, enable all RED Servers for RED appliances.
 2. Outage 2 - Disconnect all LAN connections from all REDs, leaving the RED online but with no connection to local clients.
 3. Apply the 9.605 Up2Date.
 4. After the Up2Date is complete, reconnect disconnected LAN cables to the REDs.

Cheers - Bob

2019-08-06 See my final version posted today.

UPDATED 2019-08-01

Hi All,

I've had several messages back and forth with Sophos folks.  As Jan Weber says in a post, 9.605 fixes the problem with REDs and the only danger is updating the RED firmware when the RED is under a heavy load.  I have suggested that the following instructions be added to the information about the Up2Date (I in blue dot) and the blog post about the 9.605 Up2Date:

In order to ensure that there's no problem with the update of firmware in RED devices, do the following with two planned outages:

 1. Outage 1 - Up2Date to 9.604:
     A. In WebAdmin, disable all RED Servers for RED appliances.
     B. Apply Up2Dates through 9.604.
     C. At the command line: cc set red use_unified_firmware 0
     D. In WebAdmin, enable all RED Servers for RED appliances.
 2. Outage 2 - Disconnect all LAN connections from all REDs, leaving the RED online but with no connection to local clients.
 3. Apply the 9.605 Up2Date.
 4. After the Up2Date is complete, reconnect disconnected LAN cables to the REDs.

Cheers - Bob

Hello Bob,

I still have my UTM's on 9.602-3. Do you recommend upgrading at all and if so to 9.605? I don't have any RED appliances so that's not really an issue over here.

I would go to 9.605, Arno, because of the TCP SACK vulnerability.

Cheers - Bob