Sophos UTM: After Update to 9.719 IPS not working and Snort not running

Development released a hotfix that resolves this issue on 9 March 2024 at 08:00 UTC.}
RESOLVED Advisory: IPS crashing after upgrade to Sophos UTM 9.719

Thanks bobbylam. Is it safe to assume a future update will enable the setting again? If the setting is presently ignored, I might just switch back to disable_normalization=0 to be sure...

In 9.719 we enabled normalization for improved IPS detection. However it looks like with some specific traffic, normalization causes snort to crash. We have disabled normalization with the update for now (restoring 9.718 and prior behaviour), while we investigate these crashes. 

There's no need, the update forces normalization OFF so the setting (ON or OFF) won't have any effect anymore. 

Snort Normalization FAQ: https://www.snort.org/faq/readme-normalize

Root cause...??

emmosophos What is the underlying cause of this issue? 

What does setting ` snortsettings disable_normalization` to 1 (or true?) actually do in layman's terms?

What change in 9.719 caused this issue to begin with?

Details please.  Thank you

Yes, it looks like this workaround solves the issue.

If the u2d-ipsbundle has been updated, should we be turning snort normalization back on?

Hello Community,

The following KB has been released.

https://support.sophos.com/support/s/article/KB-000045966?language=en_US

Regards,

Hi, thanks for the quick reaction.
Setting made, no problems so far.
The actual test takes place on Monday morning under normal load.