Sophos UTM 9.5 released - let's share experience :-)

RE: Sophos UTM 9.5 released - let's share experience :-)

RSeifert Seifert — Mon, 04 Sep 2017 08:23:42 GMT

could you fix it? I have the same error. for time reasons i went back to V 9.414-2

RE: Sophos UTM 9.5 released - let's share experience :-)

talex — Tue, 11 Jul 2017 07:06:20 GMT

Hi,

9.502 soft-release is available for manual installation. See https://community.sophos.com/products/unified-threat-management/f/hardware-installation-up2date-licensing/93895/utm-9-502-soft-release.

RE: Sophos UTM 9.5 released - let's share experience :-)

BAlfson — Mon, 10 Jul 2017 11:39:36 GMT

Nicolas, as Heiko said, use "VPN Pool (L2TP)" instead of having internal DHCP assign IPs. The combination of WebAdmin and the configuration demon is a very complex piece of software. After having seen what you're doing cause routing problems in most versions, I recommend against assigning IPs in "Internal (Network)" to L2TP/IPsec clients. this may be fixed in 9.502, but it's apparently a fragile construct.

Cheers - Bob

RE: Sophos UTM 9.5 released - let's share experience :-)

McWolle — Mon, 10 Jul 2017 08:23:40 GMT

Hi Guys, the release is comming on 13. July.

br McWolle

RE: Sophos UTM 9.5 released - let's share experience :-)

HeikoHund — Mon, 10 Jul 2017 05:16:36 GMT

Hi Christian

Sorry, I can't give you a date, yet. We're in the final stage of testing the release. Depending on the findings of the test cycle, the (soft-)release could be later this week or next week.

So, take that as a "soon". It's our first priority to get MR2 out, so it will be happening. Sorry, for not being able to be more precise. Hope this help anyway.

Heiko

RE: Sophos UTM 9.5 released - let's share experience :-)

HuberChristian — Mon, 10 Jul 2017 04:35:38 GMT

Hi Heiko

Do you have any Release Date for this 9.502 so far?

Best thanks

Christian

RE: Sophos UTM 9.5 released - let's share experience :-)

Nicolas MEHRING — Mon, 10 Jul 2017 03:11:26 GMT

Hello Heiko,

Thanks for your response.

This is a print screen of my config.

Thanks.

Nicolas

RE: Sophos UTM 9.5 released - let's share experience :-)

HeikoHund — Fri, 07 Jul 2017 10:05:15 GMT

Hi Nicolas,

could you confirm that you're using DHCP IP address assignment?

We've fixed this issue in the upcoming maintenance release 9.502. Currently there's no workaround besides assigning the addresses from a regular pool instead.

Sorry
Heiko

RE: Sophos UTM 9.5 released - let's share experience :-)

Nicolas MEHRING — Fri, 07 Jul 2017 09:17:27 GMT

Hello Bob,

Thanks for your reply.

I can not change "Authentication from Local to RADIUS".

Radius option is grayed out.

Thanks

Nicolas

RE: Sophos UTM 9.5 released - let's share experience :-)

BAlfson — Thu, 06 Jul 2017 13:25:33 GMT

Hi, Nicolas, and welcome to the UTM Community!

Try changing 'Authentication by' from "Local" to "RADIUS" and [Apply] and then change it back. If that doesn't work, I'd start using the SSL VPN which I prefer to PPTP in any case.

Cheers - Bob

RE: Sophos UTM 9.5 released - let's share experience :-)

Nicolas MEHRING — Thu, 06 Jul 2017 04:05:03 GMT

Hello,

I upgraded my Sophos to version 5.9 this week.

Since the update, my VPN connection no longer works.

I am using PPTP connexion. I change nothing in the configuration.

The log :

2017:07:06-09:54:42 ASG pptpd[7577]: MGR: Launching /usr/sbin/pptpctrl to handle client
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: local address = 10.242.1.1
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: remote address = 10.242.1.2
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: Client 87.240.193.45 control connection started
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: Received PPTP Control Message (type: 1)
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: Made a START CTRL CONN RPLY packet
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: I wrote 156 bytes to the client.
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: Sent packet to client
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: Received PPTP Control Message (type: 7)
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: Set parameters to 100000000 maxbps, 64 window size
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: Made a OUT CALL RPLY packet
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: Starting call (launching pppd, opening GRE)
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: pty_fd = 6
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: tty_fd = 7
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: I wrote 32 bytes to the client.
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: Sent packet to client
2017:07:06-09:54:42 ASG pptpd[7578]: CTRL (PPPD Launcher): program binary = /usr/sbin/pppd
2017:07:06-09:54:42 ASG pptpd[7578]: CTRL (PPPD Launcher): local address = 10.242.1.1
2017:07:06-09:54:42 ASG pptpd[7578]: CTRL (PPPD Launcher): remote address = 10.242.1.2
2017:07:06-09:54:42 ASG pppd-pptp[7578]: Plugin aua.so loaded.
2017:07:06-09:54:42 ASG pppd-pptp[7578]: AUA plugin initialized.
2017:07:06-09:54:42 ASG pppd-pptp[7578]: Plugin dhcpc.so loaded.
2017:07:06-09:54:42 ASG pppd-pptp[7578]: DHCPC: plugin initialized
2017:07:06-09:54:42 ASG pptpd[7577]: GRE: read(fd=6,buffer=805a560,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: PTY read or GRE write failed (pty,gre)=(6,7)
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: Reaping child PPP[7578]
2017:07:06-09:54:42 ASG pptpd[7577]: CTRL: Client 87.240.193.45 control connection finished

Can you help me please ?
Thanks.
Nicolas.

RE: Sophos UTM 9.5 released - let's share experience :-)

BAlfson — Thu, 29 Jun 2017 19:19:27 GMT

Try restoring the config backup made before the last Up2Date application. If that doesn't work, I'd consider re-imaging from ISO and restoring.

Cheers - Bob

RE: Sophos UTM 9.5 released - let's share experience :-)

AlexRomp — Thu, 29 Jun 2017 16:13:45 GMT

I wanted to post this so it came up in people's Google results.

The "Client Authentication daemon not running" error that people are getting is ALSO the same service you need to run STAS on the UTM device. It's the service that's responsible for the daemon listening on udp/6060 on the UTM.

So if anybody is having trouble running STAS to authenticate users, you also need to set the HA explicitly to off if you're not using HA. STAS should start working in a few minutes after that.

Hope this helps somebody.

Thanks!

RE: Sophos UTM 9.5 released - let's share experience :-)

SteveHart — Thu, 29 Jun 2017 15:17:02 GMT

I'm getting two different errors now.

Http proxy not running - restarted
--
HA Status : HA MASTER (node id: 1)
System Uptime : 2 days 22 hours 46 minutes
System Load : 3.22
System Version : Sophos UTM 9.501-5

I was getting this before the update (it was actually the motivation behind updating)

Also,

Support access daemon not running - restarted
--
HA Status : HA MASTER (node id: 1)
System Uptime : 3 days 21 hours 56 minutes
System Load : 1.10
System Version : Sophos UTM 9.501-5

This one is new. I just opened a ticket.

No user reported issues on these.

RE: Sophos UTM 9.5 released - let's share experience :-)

BAlfson — Thu, 29 Jun 2017 15:10:53 GMT

Steve, I think Support is being buried by this, so you just need to be politely insistent, as in the squeaky wheel gets the grease.

Cheers - Bob

RE: Sophos UTM 9.5 released - let's share experience :-)

steveatkinson — Thu, 29 Jun 2017 03:29:15 GMT

Thanks for this update, and the following one. I was given the same bug number but haven't been given the patch or even been told about it. Emailed support on Tuesday but so far had no response. Dissapointing that Sophos don't seem to be very proactive on offering said fix to affected customers...

RE: Sophos UTM 9.5 released - let's share experience :-)

SteveHart — Wed, 28 Jun 2017 12:34:11 GMT

SSO patch is still working.

Per Sophos: "In addition, UTM firmware version 9.502 should have the fix embedded and is planned for release around mid July."

RE: Sophos UTM 9.5 released - let's share experience :-)

SteveHart — Tue, 27 Jun 2017 10:39:57 GMT

The patch seems to have solved the SSO issue.

Their internal tracking number on this issue was NUTM-7960.

RE: Sophos UTM 9.5 released - let's share experience :-)

SteveHart — Mon, 26 Jun 2017 20:37:01 GMT

They just finished installing the SSO patch a few minutes ago.

So far, so good.

An interim fix was to remove the UTM from the domain.

Definitions & Users

Authentication Services

Single Sign On Tab

You remove the UTM by typing in the wrong user password. You will get a failed message, but that removes it. Do it again with the correct password and it will rejoin the domain.

That fix worked for a few hours, then it would act up again.

My workaround was to write a Web Filtering Exception that skipped authentication. Not the best solution, but we had to stay in business.

RE: Sophos UTM 9.5 released - let's share experience :-)

Gary Cutri — Mon, 26 Jun 2017 20:27:21 GMT

Thanks for the tip, I will contact support now :)

RE: Sophos UTM 9.5 released - let's share experience :-)

SteveHart — Mon, 26 Jun 2017 11:02:40 GMT

We are having this issue as well.

SSO is completely broken. I'm told there's a patch. I'm waiting for them to install it.

RE: Sophos UTM 9.5 released - let's share experience :-)

DavidLawson — Sat, 24 Jun 2017 17:10:37 GMT

On upgrade to 9.5 has anyone had an issue on reboot, with it not fully starting UTM and the reboot?

I have been searching for issues, but can't find it. On reboot I get an error regarding fsck failing and not being able to mount /root and its drops me to a bin/bash shell.

Can you direct me to a RTMF, as my STFI isn't working well.

--d

RE: Sophos UTM 9.5 released - let's share experience :-)

Gary Cutri — Wed, 21 Jun 2017 23:32:05 GMT

Another issue we are having since the 9.5 update is Chrome users are getting prompted for authentication (IE works correctly via SSO). Anyone else having issues?

RE: Sophos UTM 9.5 released - let's share experience :-)

Gary Cutri — Wed, 21 Jun 2017 20:58:39 GMT

I also had the issue "Client Authentication daemon not running -restarted" and it was resolved by turning off HA which was enabled during the 9.5 upgrade.

Go to WebAdmin » Management » High Availability » Configuration » High Availability Status and set Operation mode to Off.

RE: Sophos UTM 9.5 released - let's share experience :-)

Alex Fadeyev — Mon, 19 Jun 2017 21:21:59 GMT

Did you resolved it by any chance? I'm getting same notification every few minutes.