With the XG17 out and in full swing what does UTM9.x provides that XG17 doesn't?

Hi Michael,

yes, Billybob and I did leave some items out, but as home users we are aware of the features but have no idea if they work or not. Forum reviews might give you a better indication.

Seeing the US market has run out of IPv4 (addresses) I would have thought getting IPv6 into place would have been a reasonably high priority.

I was contemplating adding extra items to that list, so here they are.

XG allows you to direct networks/users to different gateways while using the web proxy, UTM can't. (Big advantage)

You can setup ATP rules, WEB rules and IPS rules for each firewall rule. (Big advantage)

You cannot get reports on VLAN traffic.

You still need to use CLI in XG in 2018. I know XG was written by Microsoft based on how much of MS stuff still needs to be done in CLI because the MS GUI does not have the same authority (joke).

WEB/ATP classification. The XG version is faster to respond, this is after a number of issues were raised in the forum about the performance, now how was it fixed, by moving a number of sites to unclassified, just look at your daily reports.

Ian

On web-categorization data, I have complained about this before during betas. The problem is not that the quality is not upto par to UTM. As Michael pointed out there is a lot of layer8 firewalling going on (the only thing that cyberoam brought to the table). What happens is that right now in XG you can write up firewall rules that can do QoS based on web or application categorization. So lets say you want to throttle streaming media on guest network but allow IT related websites with minimal throughput restraints. Due to bad categorization, certain websites hog the whole bandwidth while you thought you were controlling them correctly. To compensate for that you are back to IP based QoS so one step forward but not quite yet. I never insinuated that you have to wait a whole year for the data to get better. However, sophos' standard response is to submit a url. That is great for open source projects but not really what customers want to hear after paying thousands of dollars for an appliance. On general webfiltering, speed wise, XG is definitely faster and certain websites that balk and don't render correctly using proxies in UTM usually have little problems with XG.

Same with application control... UTM9 has always categorized my netflix traffic correctly and XG still doesn't. I just throttle my streaming devices so that those netflix 4k streams are not downloading multiple terrabytes on their own. But thats because they wanted XG to be grouped with nextgen firewalls and want to use snort for application categorization instead of netfilter doing layer7. You can't write your own rules for either so really doesn't matter other than the fact that snort has to run full time even though you are not doing any kind of IPS filtering for application control/application categorization/application QoS to work correctly.

I didn't mention synsec (synchronized security) because unlike UTM9 endpoint protection that allows a few endpoints even for home users (hence the rant about the love for astaro) is a completely different subscription. Same with sandstorm. I have seen sandstorm in action and while the concept is great, the wait time during regular websurfing is too long. It is good for email protection etc. but its comparable in both UTM and XG. Synchronized security looks better on paper than in real life. Don't get me wrong, it works great for what it does but for people not familiar with the concept, think of it like norton enterprise antivirus solution. Your management console gives you all the alerts and the endpoints are quarantined etc. on the basis of the policies defined. Sophos is just taking it a step further and adding applications to it and since the firewall has a say in routing, it can block the endpoint and quarantine it completely. Still, its another subscription on top of your regular license.

The main problem I have always had with XG is not what the brochure says about the product but what it can actually deliver. I want some kind of feature parity with UTM but I never asked for a clone. XG has a lot of quirks, port renaming is not feature parity, its something I regularly do on every device I own. Its easier to remember, LAN, WAN, DMZ instead of port1, port2 etc. Global QoS with multiple WAN lines with different bandwidths is not feature parity it really needed when your main line fails and your layer 8 rules are worthless because your WAN bandwidth just became 1/4 of what it is usually. NAT rules are just basic stuff that has been available in linux yet XG has hard time DNATTING traffic. Open source MTA servers are being used all over the world but they have been trying to invent one for XG since v15 and at v17... we are still inventing the wheel. Wifi GUI, as dated as it is in UTM still gives me accurate data on signal strengths and information that I want while XG gets stuck on what the client originally connected at.

The layout of items in XG GUI is very unintuitive. Where would you look for QoS settings in a firewall...somewhere in networking? In XG it is under system services[:|] You are not done yet... you still have to go apply that qos to the web or application policy and then use that policy in a firewall rule before the QoS starts working. This is quirky as hell and has nothing to do with feature parity. Clientless users require an email address... really? your printer has an email address? 

Finally the abandonment of UTM platform. Yes, it has been abandoned. Its like sophos had a world class rocket sitting in the hangar and they chose a prop plane because it was cheaper and came with a development team. Yes, XG has a lot of new "flashy slogans" synsec, nextgen, you name it. Its also true that UTM didn't need much when sophos acquired it but UTM is still where it was when XG v15 was introduced and there is no telling how much money went into developing XG from there on. Yes we all understand UTM is dead and there is no point in selling one now, but its a hard pill to swallow for people that are on their second or third year of UTM9 license with renewals just on the horizon.

Regards
Bill

Billybob said:

and finally INTENTIONAL SABOTAGE AND DOWNRIGHT DESTRUCTION OF THE UTM9 platform. I have been using UTM since v4 and even though I could roll my own redhat linux distros back in the day and run snort and squid etc on separate boxes to protect my network, Astaro made it so simple. On top of that, the philosophy of sharing and caring that astaro had is something that I greatly miss. After acquiring cyberoam, sophos has pretty much abandoned the UTM platform. Sandstorm is the only thing added to UTM other than mostly patches for vulnerabilities. Same old gui since v7/8 days, same daemons (some optimized) and honestly, it is showing its age. They are still charging full prices for licenses and yet all the development is being done on XG. Whoever decided to kill UTM in favor of cyberoam most likely for cost saving measures probably ended up costing the company more in development time to get XG running.

I can keep on rambling but this is how it is and although the usual people will come and say its all good, it really is not.

100x THIS!!!!! can't agree more! In 2 years our UTM Subscriptions will be due again and if the current state doesn't change we will probably be not renewing for 3 years again but look for options!

Ben said:

100x THIS!!!!! can't agree more! In 2 years our UTM Subscriptions will be due again and if the current state doesn't change we will probably be not renewing for 3 years again but look for options!

Well at the pace of things today, i'm even wondering if these old school gateways at a perimeter will still be relevant in 3 years. I mean DPI is a hack and nothing else, technologies like HSTS render's such devices completely blind, disable pretty much any captive portal usability (yes yes, teach a user to request 1st an http web site, absolutely), per definition annihilate MiTM DPI. Currently, I'm battling with SSO on a UTM in order to get the users fully authenticated, the gateways knows the user already either per SSLVPN daemon, RADIUS WPA2 Ent WiFi auth and you name it and i'm still not authenticated as a full gateway user (at the UTM layers), useless.. This is so old school that i'm wondering really how long this will make any sense.. At the end with full encryption everywhere the only really important piece of gear has shifted back to the end point if you ask me...

Hi,

they will still be relevant to stop open attacks on devices that do not go to the internet (and by inference have no real network security) and/or until the IoT of things improve their security.

Ian

Mokaz said:

I mean DPI is a hack and nothing else, technologies like HSTS render's such devices completely blind, disable pretty much any captive portal usability (yes yes, teach a user to request 1st an http web site, absolutely), per definition annihilate MiTM DPI.

HSTS is irrelevant as long as the client has the XG's Certificate Authority installed and HTTPS scanning on.  Any device that is in Active Directory should have the CA pushed to it automatically.  Then Captive Portal and MiTM DPI works fine, even on HSTS sites.  BYOD phones are a different issue because installing CA on them is a pain.

Before concluding that XG is worth considering as a UTM replacement, I would like to know if it handles certificate security correctly.

So far, my post in the XG forum has no responses.

community.sophos.com/.../certificate-validation-questions-for-web-filter-and-waf

Curious that you think that endpoints can be effectively protected.    My experience is that there are always some that are misconfigured, so our strategy is to minimize mobile usage and rely heavily on good perimeter defenses.

I put up a post 6 months ago, asking about defending mobile devices against malware and internal networks against infected mobile devices.   I thought I would get some stories about how easy it would be if I bought more of the Sophos product line.   But it received zero responses, not even a sales pitch.   Certainly left me feeling that nobody else had a mobile device security plan that they thought was rugged enough to deserve bragging rights.

Oh no not really, i do not think that EP can be "effectively" secured, i'm no End Points solution expert at all. What i think is rather that they actually pretty much "are" at the end of encrypted traffic, which makes them under certain circumstances (like no DPI policy) the 1st in line to actually potentially discover what exactly that gathered content is.. Hence my remark on the fact that i do think that more and more the EP should get more attention..

Also as somebody here said, installing a DPI cert on BYOD is now almost impossible/or at least very painfull; i've tried on some of the latest Android devices; you simply can't get the cert to install (aside on Firefox itself). (I haven't spent much time at trying to hack my way around this really..)..

And also, when i've been talking about old school gateways, that doesn't translate to Sophos "only"; its pretty much the same standings with every vendors really.

Cheers,

-m-

I was at a technical workshop for XG this week and as far as I can say: XG is on the right way but still some things are missing and also some things(IPsec) had to be fixed with the next update.

When comparing SG and XG keep an eye on these things:

• Black- and/or Whitelist for E-Mail Protection are missing in XG - on "to do list" for later updates
• BATV and SPF-Checks are missing - on "to do list" for later updates
• You can not change Ports for SSL-VPN and Userportal -  on "to do list" for later updates
• E-Mail Encryption with S/MIME and PGP is missing and is NOT planned for XG (We have a few customers (Automobile/Pharmacy) that use this feature with SG...)