Can someone point me to a document detailing the procedure to completely reinstall a UTM? What do we do if our system is down?. We have two units configured in HA mode.
I'm hoping I'll never need it, but it's required for our security policy.
Steve, factory reset only wipes all configuration. The only way to rollback to a previous version is to reimage the device.
Couple things I like to make sure:
1) That I receive configuration backups regularly on my e-mail (https://www.sophos.com/support/knowledgebase/115189.aspx) and that those backups are safely stored somewhere I can access if the UTM is down. That would ensure that you have at least a few backups compatible if previous releases if you need to rollback. Keep in mind that an UTM with higher version will be able to restore a backup taken from a previous versions, but an UTM with lower version will not be able to restore a backup taken from newer version. You might lose a few recent changes if it come down to it, but it's better then reconfiguring everything from scratch if you ever need to rollback.
2) Keep a few ISOS with previous UTM versions at hand. I have a 9.2x, 9.3x and 9.4x laying around, just in case. You don't want to be caught in a situation where you need a internet connection, that will obviously be offline if your UTM goes down, to restore your firewall.
3) If you run a critical business and a failed upgrade is a concern, you should consider keeping a node reserved during up2date: https://www.sophos.com/en-us/support/knowledgebase/117507.aspx. That way, if something goes wrong, you simply shutdown the master node and the slave node (that was reserved with the version that was running before the upgrade) goes online. Be aware that you will not have HA again untill you reimage the node that was shutdown with the same version of the running node and rejoin it to the cluster.
4) As Sachin pointed out, the official way to reimage an UTM device is to have an USB CD-ROM drive and a CD burned with Sophos UTM ISO, but who has a USB CD-ROM drive nowadays? Luckily, you can reimage using a USB stick and a few tweaks during the installation. Take a look at http://networkguy.de/?p=728
Hope it helps.
Regards - Giovani
P.S: Sorry for any typos. English is not my native language.
Steve, factory reset only wipes all configuration. The only way to rollback to a previous version is to reimage the device.
Couple things I like to make sure:
1) That I receive configuration backups regularly on my e-mail (https://www.sophos.com/support/knowledgebase/115189.aspx) and that those backups are safely stored somewhere I can access if the UTM is down. That would ensure that you have at least a few backups compatible if previous releases if you need to rollback. Keep in mind that an UTM with higher version will be able to restore a backup taken from a previous versions, but an UTM with lower version will not be able to restore a backup taken from newer version. You might lose a few recent changes if it come down to it, but it's better then reconfiguring everything from scratch if you ever need to rollback.
2) Keep a few ISOS with previous UTM versions at hand. I have a 9.2x, 9.3x and 9.4x laying around, just in case. You don't want to be caught in a situation where you need a internet connection, that will obviously be offline if your UTM goes down, to restore your firewall.
3) If you run a critical business and a failed upgrade is a concern, you should consider keeping a node reserved during up2date: https://www.sophos.com/en-us/support/knowledgebase/117507.aspx. That way, if something goes wrong, you simply shutdown the master node and the slave node (that was reserved with the version that was running before the upgrade) goes online. Be aware that you will not have HA again untill you reimage the node that was shutdown with the same version of the running node and rejoin it to the cluster.
4) As Sachin pointed out, the official way to reimage an UTM device is to have an USB CD-ROM drive and a CD burned with Sophos UTM ISO, but who has a USB CD-ROM drive nowadays? Luckily, you can reimage using a USB stick and a few tweaks during the installation. Take a look at http://networkguy.de/?p=728
Hope it helps.
Regards - Giovani
P.S: Sorry for any typos. English is not my native language.
