Sophos UTM 9.510-4 released - let's share experiences!

Hi,

same issue here. I installed 9.510 on my SG 105W at home. I´m not using mail protection, but I checked the mail manager before and after the installation.

After the installation i get the same error message "invalid request".

Maybe mail manager is no longer necessary... Sophos fixed the quarantine report release option for end users (NUTM-9836) instead ;)

Kind regards

Daniel

Hello,

I got the same error, in Edge, but in Chrome, Firefox and IE Mailmanager works perfectly.

Then i went to another PC and from there Mailmanager opened in EDGE without problems.

But i got an other serious error in this Release: RCPT Verification with callout doesnt work. Mails are not processed. Example of my logfile:

2018:07:20-09:25:01 sophos-2 exim-in[32250]: 2018-07-20 09:25:01 [46.254.125.74] F=<sender Address> R=<recipient Address> Verifying recipient address with callout

2018:07:20-09:25:01 sophos-2 exim-in[32250]: 2018-07-20 09:25:01 TLS error on connection from <Senders Mail Server>:34983 (renegotiation not allowed): error:00000000:lib(0):func(0):reason(0)

The connection  closed and the mail would not be processed.

As a workaround, RCPT Verification in AD works as expected.

As another workaround i had added <any> under SMTP/Advanced in the Box 'Skip TLS Negotiation Hosts/Networks' and now Callout is working as before...

But i think its not a good way to disable TLS...

Marco

Unknown said:

Hello,

 

I got the same error, in Edge, but in Chrome, Firefox and IE Mailmanager works perfectly.

Then i went to another PC and from there Mailmanager opened in EDGE without problems.

 

But i got an other serious error in this Release: RCPT Verification with callout doesnt work. Mails are not processed. Example of my logfile:

 

2018:07:20-09:25:01 sophos-2 exim-in[32250]: 2018-07-20 09:25:01 [46.254.125.74] F=<sender Address> R=<recipient Address> Verifying recipient address with callout

2018:07:20-09:25:01 sophos-2 exim-in[32250]: 2018-07-20 09:25:01 TLS error on connection from <Senders Mail Server>:34983 (renegotiation not allowed): error:00000000:lib(0):func(0):reason(0)

The connection  closed and the mail would not be processed.

As a workaround, RCPT Verification in AD works as expected.

 

As another workaround i had added <any> under SMTP/Advanced in the Box 'Skip TLS Negotiation Hosts/Networks' and now Callout is working as before...

 

But i think its not a good way to disable TLS...

 

Marco

 

I too can confirm this!

Unknown said:

Hello,

 

I got the same error, in Edge, but in Chrome, Firefox and IE Mailmanager works perfectly.

Then i went to another PC and from there Mailmanager opened in EDGE without problems.

 

But i got an other serious error in this Release: RCPT Verification with callout doesnt work. Mails are not processed. Example of my logfile:

 

2018:07:20-09:25:01 sophos-2 exim-in[32250]: 2018-07-20 09:25:01 [46.254.125.74] F=<sender Address> R=<recipient Address> Verifying recipient address with callout

2018:07:20-09:25:01 sophos-2 exim-in[32250]: 2018-07-20 09:25:01 TLS error on connection from <Senders Mail Server>:34983 (renegotiation not allowed): error:00000000:lib(0):func(0):reason(0)

The connection  closed and the mail would not be processed.

As a workaround, RCPT Verification in AD works as expected.

 

As another workaround i had added <any> under SMTP/Advanced in the Box 'Skip TLS Negotiation Hosts/Networks' and now Callout is working as before...

 

But i think its not a good way to disable TLS...

 

Marco

 

I too can confirm this!

New update on Mailmanager bug:

Firefox: "Invalid request"

Chrome on SAME UTM: ALL GOOD!

Firefox as before, but cleared cookies and website data: ALL GOOD!

:-)

Well done :)

Worked for me too. Cleared all data in Firefox and the mail manager works like a charm.

Kind regards

Daniel

Hello Marco,

i think it is the TLS Renegotation protection.

show there https://wiki.mozilla.org/Security:Renegotiation

i have TLS1.2 activate and it running.

br Christian

My name in the callout verification tls issue hat as well.  Hopefully a quick 9.510-5+ build with the appropriate fix.

Anyone opened a ticket on this yet?

you can switch the TLS-Version to 1.2 in the advanced tab since 9.510. After that, callout verification works.

No luck. After switching to TLS 1.2 the same error occurs:

My bad! This is incorrect information.

Hi!,

I upgraded to 9.510-4 and have Recipient Verification with callout problems.

A few day's I opened a ticket regarding this issue.
Anyone else having this same problem or ticket opened ? 

Regards, Stephan