DO NOT INSTALL 9.703-2!!!

RE: DO NOT INSTALL 9.703!!!

Sophos User287 — Mon, 06 Jul 2020 06:45:46 GMT

The issue is resolved now. It was an MTU issue disrupting OSPF which for some reason has changed but either way, both nodes are updated and working fine again. The update is fine.

RE: DO NOT INSTALL 9.703!!!

FormerMember — Fri, 03 Jul 2020 12:58:54 GMT

Hi Sophos User278

I would advise you to Open a Support Case for further investigation and PM me the case number.

Thanks,

RE: DO NOT INSTALL 9.703!!!

Sophos User287 — Fri, 03 Jul 2020 04:51:29 GMT

I've installed the 9.703-3 update on a 9.702 system and I'm having the same issue as the original faulty 703 update that was pulled. Can't access the admin webpage, not a lot of traffic is being passed etc etc. Have rebooted and switched back to the slave and still no good.....

RE: DO NOT INSTALL 9.703!!!

emmosophos — Tue, 23 Jun 2020 22:56:55 GMT

Hello,

To update the Community regarding TomMorgan CPU issue,

His client's issue was related to older hardware that unfortunately had certain settings mis-configured. This caused the CPU spike, and the problem was resolved after the device was factory reset and reconfigured properly.

Regards,

RE: DO NOT INSTALL 9.703!!!

FormerMember — Mon, 15 Jun 2020 21:12:35 GMT

Hi Dread

I would advise you to open a support case and PM me the case number for further investigation.

Thanks,

RE: DO NOT INSTALL 9.703!!!

Dread — Mon, 15 Jun 2020 00:07:31 GMT

Installed 9.703-3 overnight ... and now Office 365/AD will not Sync and no-one can use Single Sign on to any of the Enterprise Apps installed with Office 365

ANyone else having this issue?!?!

RE: DO NOT INSTALL 9.703!!!

FloSupport — Tue, 09 Jun 2020 08:29:40 GMT

Hi TomMorgan

I'll follow up with you via PM to get your support case number to investigate further.

Thanks,

RE: DO NOT INSTALL 9.703!!!

TomMorgan — Wed, 03 Jun 2020 20:35:34 GMT

Will do...

Tom

RE: DO NOT INSTALL 9.703!!!

BAlfson — Wed, 03 Jun 2020 20:09:57 GMT

Hey Tom,

Please let us know what Sophos Support has to say about this.

Cheers - Bob

RE: DO NOT INSTALL 9.703!!!

TomMorgan — Wed, 03 Jun 2020 16:38:29 GMT

On one box that I manage that was running 9.702-1, I set Up2Date on manual when I saw this problem initially in April. I didn't get back to it until 5/30 when I noticed that a 9.702-1 to 9.703-3 was available. After applying the update I've had 100% CPU spikes every 3 hours exactly and memory usage correspondingly high and erratic. Today I turned off web filtering and set both Up2Date's to manual. This seemed to have stopped the 1 hour CPU spikes but this was not a problem with the previous firmware.

Has there been any such thing being reported elsewhere? I've not been able to find anything else in the box that may cause this.

Tom

RE: DO NOT INSTALL 9.703!!!

rfcat_vk — Mon, 01 Jun 2020 02:04:57 GMT

Currently expected, but not promised in the week starting the 8th of June 2020.

Ian

RE: DO NOT INSTALL 9.703!!!

BAlfson — Sat, 23 May 2020 19:02:23 GMT

Based on comments here in the Community and my persistence, Sophos actually removed 9.703-2 from the Up2Date servers even though they had yet to reproduce the problem in their labs. Sophos deserves a pat-on-the-back for breaking their own rules in dealing with this issue.

9.703-3 works great!

Cheers - Bob

RE: DO NOT INSTALL 9.703!!!

bobbylam — Thu, 23 Apr 2020 17:37:10 GMT

First of all, I would like to sincerely apologize to anyone who was affected by this issue. There was a gap in our testing for this 9.703 release, and the problem should've never made it into the field. Additionally we should've reacted more quickly when some of you reported this issue on the forums.

As you can see from the KBA that was posted, we have done a detailed analysis on what went wrong (not just the bug, but how we reacted & our testing process), and have/will put improvements/additional safeguards in place to ensure something like this doesn't happen again. We will learn from this, and continue to improve.

As for whether this is another RED50 issue: Fundamentally this issue and the RED50 problem are very different. The RED50 issue was related to the hardware (specifically how the driver reacts when the underlying flash storage degrades - which is normal for flash drives), and it took us a long time to reproduce the problem even after getting failed units shipped back to Engineering for analysis (it is indeterministic when flash drives will degrade). Once we were able to reproduce/see the problem, we moved quickly to address it (the delay wasn't due to a lack of focus/trying). This 9.703 issue does not have any hardware component, and we were able to reproduce, isolate & understand the problem quickly, so we can confidently say the new 9.703 update that was re-released today has the problem addressed.

Again I would like to apologize to all who were affected by this issue. We should be better, and we will be. I also would like to thank BAlfson for reporting this issue first, and working with us on the solution.

RE: DO NOT INSTALL 9.703!!!

EgonSommer — Thu, 23 Apr 2020 17:21:14 GMT

@FloSupport

Hi, thanks for your info. Would you please keep us informed about the new XG V18 MR1 ?

RE: DO NOT INSTALL 9.703!!!

FloSupport — Thu, 23 Apr 2020 17:02:30 GMT

Hi All,

UTM v9.7 MR3 was re-released on, 23 April 2020.

More info available in the UTM release notes post.

Regards,

RE: DO NOT INSTALL 9.703!!!

Argo — Wed, 22 Apr 2020 11:25:48 GMT

I agree it is novel that we are actually told something constructive from Sophos.

but is this premature? are we looking at another RED issue that was not fixed for six months (even though they 'said' they had fixed it twice)? - apologies the cynic in me came out ...

I do understand that they do a lot of work in the back-ground, the UTM has had little or no information about updates, new builds, EAP or Road Maps. Will this change now?

Although this should not have happened in the first place!

will I get some sort of recompense for having to go into work (on Bank Holiday Monday) to fix the issue (by rebuilding the firewall from scratch)?

I always try to look on the positive side, the issues with the UTM and associated equipment has been un-helpful.

RE: DO NOT INSTALL 9.703!!!

PhilippRusch — Wed, 22 Apr 2020 08:25:15 GMT

Hello Flo_Support,

this is the first time I feel like being informed about this matter in a timely manner and directly from a Sophos source. I appreciate that very much.

RE: DO NOT INSTALL 9.703!!!

FloSupport — Wed, 22 Apr 2020 00:20:29 GMT

Hi All,

A new v9.703 update is currently being tested, and is targeted for release during the week of Apr 20. Both customers running on v9.702 and the previous version of v9.703 will be able to upgrade to this new version.

The Advisory KBA has been updated to provide more information regarding this incident:

Advisory: Sophos UTM - Traffic not passing after upgrading to v9.703

Regards,

RE: DO NOT INSTALL 9.703!!!

BAlfson — Tue, 21 Apr 2020 19:27:26 GMT

Apparently, there's a patch for 9.703 that fixes a conflict that 9.703 had with IPsec. I will test that in about 3 hours.

Cheers - Bob

RE: DO NOT INSTALL 9.703!!!

asg_user — Tue, 21 Apr 2020 09:28:15 GMT

The database file with the spx data should be: /var/storage/chroot-smtp/spx/auth/spx-auth-v2.ks

Regards,

Marco

RE: DO NOT INSTALL 9.703!!!

Herr Merlin — Mon, 20 Apr 2020 15:02:59 GMT

When will a fix probatly released?

I have some medical instution as customers, who already patched to 9.703 and now we have some major issues. Like massive ping drops via RED UTM to UTM tunnel.

As we can not simply take them down and reinstall, as this would affect to much services..

Now they have a problem with voice as this transits via the RED tunnel.

Any news on the fix yet?

RE: DO NOT INSTALL 9.703!!!

zaphod — Sun, 19 Apr 2020 20:04:14 GMT

Hi Wilfried,

maybe (but really maybe) a short look in the REST API can help to get your SPX recipients back.. but only if you have a machine with the old database running and useful to get REST calls running on it. as far as i read if you run into this bad firmware bug the machine becomes usesless after short uptime :-(

hope others has suggestions to help you fix this out.

RE: DO NOT INSTALL 9.703!!!

wrj — Sun, 19 Apr 2020 19:06:47 GMT

Sorry, Bob,

that has been our experience. Our sorry experience has cost us € 1.700 so far.

Here's the timeline:

2019-12-18 we order our second SG230
2020-01-08 we run into the SPX PWD problem and contact our supplier
2020-01-19 they cannot help & refer us to Sophos directly
2020-01-25 we order 1 yr. Sophos "Premium Support", the above mentioned ticket is started
2020-02-14 they tell us that "currently SPX registered recipients cannot be saved or included in the backup" (I call that a bug, not a feature request)
2020-02-25 the ticket is basically closed by Sophos Premium Support with the following statement & suggesting more paid help by their Professional Service Team:

I can neither confirm nor negate whether a partial port of the corresponding database table is possible (and whether support for any problems resulting from this is still guaranteed).

Our management was not inclined to "chase good money after bad", so we left it at that. Case closed.

Until Sophos nuked us all with 9.703-2 ... So, is there anybody out there who can help?

Best regards,
Wilfried

RE: DO NOT INSTALL 9.703!!!

BAlfson — Sun, 19 Apr 2020 16:35:00 GMT

Hallo Wilfried and welcome to the UTM Community!

I can't believe that no one at Sophos knows where those keys are stored. Have you tried opening a case with Sophos Support?

Cheers - Bob

RE: DO NOT INSTALL 9.703!!!

wrj — Sun, 19 Apr 2020 12:28:52 GMT

twister5800 wrote the following post at 17 Apr 2020 9:18 AM:

Reformat with 9.702 iso and restore backup file :-/

-------------------------------------------------------------------------------------

Wish we could do that...

May I call your attention to this suggestion made over 2 years ago? Implementation of this feature would have saved our butts with Sophos' current screwup!

We've been running an SG 230 Rev. 1 for a number of years and were quite happy with it - until we purchased a second SG 230 and stumbled across the a. m. issue Thorsten had discovered. This rendered our new Rev. 2 machine totally useless. We couldn't use it for HA or as a backup machine. The "Premium" support we contracted was no help at all ([#8609926] Backup email addresses of users registered for SPX -- Priority: Medium -- Level: Premium 25. Februar 2019, 13:34 Uhr):

as stated in the previous emails, the functionality you requested is not and will not be provided by Sophos UTM for the foreseeable future.

Until that day we had believed that "Create Backup" meant saving everything needed for a COMPLETE restore - but obviously "unique site data (license, passwords, certifcates/keys)" does not entail the SPX email accounts and PWDs.

We have roughly 1.500 SPX accounts which need to be transfered from our shot Rev. 1 system with 9.703-2 to our up-and-running Rev. 2 machine with 9.702-1.

Any suggestions? (How) Can we transfer the SPX database files from one appliance to the other? Can we revert to 9.702-1 without losing said SPX data?

Thanks & best regards,
Wilfried