Time to Move on

This is a tricky thread to jump into! it's going in several directions at once, so I'll try to respond to these different directions, with some perspective from within Sophos.

 1) William, I'm sorry to see you go. you've been a staple of this community for many years, and you'll be missed. I do wish you well, and understand your frustrations. I can't speak to your sales frustrations, but I know we have publicly disagreed on points in the past on technical matters in these forums. All I can say, is sometimes the right solution is not nearly as straightforward as it may seem. I sincerely mean it when I say good luck to you as you change path.

2) Astaro vs Cyberoam - This is such a hard topic to comment on. There's just so much to say, and not enough space to say it all. Without getting too long-winded, XG is not about preserving money spent on cyberoam (I'm pretty sure Sophos paid more for Astaro than Cyberoam), or about choosing Cyberoam over Astaro. Yes XG is in some ways, the next version of Cyberoam, but in many more ways, its far more than that. all of the core security features in XG are either taken from UTM9 directly, or at least significantly enhanced with capabilities from UTM9. I've writen on that before, and won't expand on it again, in this thread. 

Of course XG still needs some improvements that many of you consider very basic, but it's not so black and white as many of you express. There's a clear line of differentiation on opinion, depending on your background. Customers coming in from competitors firewalls typically find XG very compelling, with few or no caveats. Those who object to XG, are most commonly those who were most appreciative of UTM9's UX design. In many ways, UTM9 has superior usability on a micro level, but not on the macro level. What I mean, is that UTM9 has a better implemented object model, with fairly consistent support for enable/disable and renaming, and it has some more powerful object types, like unified hosts, and availability groups. These make a big difference in specific tasks, and when configuring specific features, but don't greatly contribute to the overall discoverability and usability of UTM9. XG's object model is still a couple steps away from what UTM9 offers, but it also solves some of the biggest usability problems UTM9 has. Config is far too spread out in UTM9. Web and app control are intimately related to each other in purpose, but in UTM9, are confusingly different. One is fully user-aware, and the other is not. They're configured in different sections, so if you want create policy relating to a web application, you may need to independently setup web and appcontrol policies, and because of the incomplete user awareness, it's very difficult to match them up completely. In XG, they're not fully equal either, but they are much closer. A single rule applying to a group of users, can apply both web and appcontrol policies per user or per group. That's one example, and there are more. UTM has its strengths, but so does XG, and the strengths in XG are growing every version. v17 will make many more improvements. many of you PM me with suggestions or comments, and I welcome your feedback on what we need to improve. I promise you, I will always give your suggestions fair consideration. 

3) Finally, does Sophos care - yes, very much so. Is your voice being heard? absolutely. It may not always feel like it, and it won't always change our company direction - especially if you're asking us to make major investments in Cyberoam or UTM9. We've said publicly many times now, that we won't. You may not like the volume of improvements in v16/16.5, but the improvements chosen in 16/16.5/17 almost entirely echo requests directly coming from this community. 

With any company, support is often the victim of blame when people feel unheard, and often, the product itself is a factor in why support is less responsive than needed. Sophos is continuing to make serious improvements both to support and to usability and quality. We've done extensive review of what is taking up support's time, and we've been putting out a steady pattern of maintenance releases this year. Each one targeting ways we can make minor improvements to help eliminate the most common reasons people contact support. You'll see some usability improvements on areas of initial setup that cause people confusion today, as well as resolving bugs in each release. For instance, in MR3, we fixed a workflow problem with registration, and also added registration deferral. In MR4, we are adding links to training and how-to videos in the product. In MR6, we will release a completely new initial setup wizard, that also further improves the registration process. These, along with the issues resolved in each MR, are measurably reducing the support costs of XG, and making support better able to help when needed. We're also continuing to increase the size of our support teams, and you should be seeing the results of these actions now. 

4) Sophos vs PFsense - Really? Sophos, no question! :) 

Hopefully, this give some friendly Sophos perspective on this conversation

Cheers,

-AT

AlantT: thank you for the lengthly write about SG/XG. My problem as a current customer with 2 full guard subscriptions (1 since 2009) is that i don't see XG coming out as a replacement for UTM in the next 2-3 years (at the current development pace), the lack of commitment to UTM since announcement of the XG was a major point in looking for alternatives. Currently me and my collegues see the Sophos UTM as the best product for our user case if we can combine it with a "next gen" packet filter / DPI product (two level firewall)

While i think it is healthly as a technical product manager for sophos to believe in the future of a product you spend alot of money and time on, one has to admit that the current state of XG does more damage to your reputation as a security company than good. If sophos were to go EOL in the next 12 month i can assure you 100% that the decision will not go towards XG. I know a lot of SG UTM users and professionals who think the same, even the Sophos UTM Partners we are working with all more or less say the same. If you look over the community forum with open eyes you will notice that there isnt really anyone who would remotely consider moving to XG, not just because of the lack of features, but also for the fact of the XG having one of the worst user interface experiences.

If you are saying XG will get there ill take your word for it at the moment if you give us a roadmap for the next 3-4 years and invest heavily into development.

But we don't have the luxery of beeing able to hold on that long and nobody wants to switch to the XG currently. So, you should consider properly investing and developing in the UTM and listening to those who still choose to buy your products. (just renewed/bought 3 years full guard for both machines) As your customer understand that i don't want the XG (not even remotely) unless there will be a major rewrite and not these bi-annual small steps that MIGHT get us somewhere in a few years when it will be technical old.

We are allready paying for old solutions in regards to e-mail security and IPS (DPI), application control thanks to new innovative Web technology is only partly reliable these days on sophos UTM, yet there is no effort beeing made, so why charge money for that? You allready charge extra for sandstorm which SHOULD be a feature of full guard just to - please excuse the expression - milk more money out of the UTM, yet according to people who use it its not as good as advertised. UTM is a Firewall with a great UI just right for small and middle sized companys.

What i am trying to say is, a large base of your customers tells you what we want, either you deliver or you won't get our business some day. The UTM in the current form is the reason for business currently, but we expect more investment in it than simple bugfixing and not putting that money into the XG if we pay the full full guard subscription and you want us to renew in 3 years. If i wanted a next gen firewall with state of the art DPI it would probably be one with a fish name or that of a famous u.s. tech town.

Ben, I understand your skepticism, and thank you for an honest reply. I will try to be as candid in return. In this community, there is a definite opinion slant against XG, so I understand how you might believe that is an accurate sample of our users in general - but it's not. While being mindful that we are a public company, and it is difficult to speak bluntly on financial futures, I can say that your statement that "nobody wants to switch to the XG currently", just doesn't hold up. With strong sales, we also see a significant percentage of XG firewalls today are migrated from UTM9, and the biggest hurdle to that growing further, is an automated migration path, not a lack of features or functionality. 

"What i am trying to say is, a large base of your customers tells you what we want, either you deliver or you won't get our business some day."

You're absolutely right, and we are all very mindful of this, every day.  Please don't take this to imply that we don't care about bringing UTM9 customers forward. we do, very much care about that, and I still plan to bring every valuable nice-to-have bit from UTM9 into XG. Even drag-and-drop will likely make a re-appearance in v18 :) We won't ever publish a 3-4 year roadmap, for many reasons, but we are investing heavily in development, and will deliver the features that our users are asking for, and I hope you'll be positively surprised by the timeline. In the mean-time, whether you agree with me or not, XG has proven itself to be a viable alternative to UTM9 in most cases. 

Hi Alan,

thank you for taking the time to provide a detailed look at XG compared to UTM from a Sophos business point of view.

I have using UTM for many years and the XG since v15b. New customers who have never experienced UTM would be quite happy with the XG.

Simply put, I have not found configuring the XG to achieve the same things I have done in the UTM easy, requires different thinking. But things like site blocking do not work as well as the UTM try comparing my standard test of searching for naked women in both devices, XG using the provided ATP type stuff lets most of the porn through while UTM blocks 90%, was 100% until I had to fix a google issue. Will back the google fix out because it is now the way certificates are handled and turn off https scanning for the moment, home user.

IPv6 just a failure, at least some of the functions work in the UTM and have for sometime.

Country blocking well perhaps you have read the thread on this subject

XG home user memory, a comical farce and that is being polite. The developers can't even build a home user licence in a VM in the Sophos lab, leaves a lot to be desired in instilling confidence in the development team.

This weekend I will put my XG back online and try bringing the filtering up to the UTM standard.

Ultimately the XG will be the way to go looking at other products. Hopefully v17b will be out soon.

Hi Alan,

thank you for taking the time to provide a detailed look at XG compared to UTM from a Sophos business point of view.

I have using UTM for many years and the XG since v15b. New customers who have never experienced UTM would be quite happy with the XG.

Simply put, I have not found configuring the XG to achieve the same things I have done in the UTM easy, requires different thinking. But things like site blocking do not work as well as the UTM try comparing my standard test of searching for naked women in both devices, XG using the provided ATP type stuff lets most of the porn through while UTM blocks 90%, was 100% until I had to fix a google issue. Will back the google fix out because it is now the way certificates are handled and turn off https scanning for the moment, home user.

IPv6 just a failure, at least some of the functions work in the UTM and have for sometime.

Country blocking well perhaps you have read the thread on this subject

XG home user memory, a comical farce and that is being polite. The developers can't even build a home user licence in a VM in the Sophos lab, leaves a lot to be desired in instilling confidence in the development team.

This weekend I will put my XG back online and try bringing the filtering up to the UTM standard.

Ultimately the XG will be the way to go looking at other products. Hopefully v17b will be out soon.