After updating to 9.501-5 SSO for HTTP authentication failed and domain join not working.

Same problem here. Upgraded the firmware this morning and then the issue started.

Hello,

A fix for this issue is coming in MR2 which will be available soon, we apologize for the wait. You can also contact Sophos Support who will be able to apply a hotfix.

Thank you,

Bob

Clearly, it's too late to help you, Mark, but others may be able to benefit...

Never call Sophos Support.  Email them only (support@sophos.com or utm-premium@sophos.com if you have premium support).  My response to the email above would have been short: "Please escalate urgently."

Also, if your reseller isn't informing you about when you should apply Up2Dates, find a better partner for your Sophos products.  It's basic customer service and marketing 101 for products like these.

Cheers - Bob

"Also, if your reseller isn't informing you about when you should apply Up2Dates, find a better partner for your Sophos products.  It's basic customer service and marketing 101 for products like these."

Forgive me for expecting Sophos to test and support a product they sell and charge an annual licensing and support fee for.  I'll throw my reseller under the bus instead. 

Or not.

I'm not excusing Support's failure with you - that definitely reveals an organizational problem.

I'm just telling you what most of us do.  None of our clients have seen this bug because they're all on 9.413.  I've been in the IT world for 40+ years both in the USA and Europe and, for a complex product like this one, the approach I've described has always been the standard.  My wife is a storage administrator for a large organization with hundreds of terabytes behind an IBM SVC.  They plan their upgrades meticulously and they never put Operations at risk.  It has happened that IBM, to whom they pay a lot more money for support, has released buggy code that brought down the SVC at their backup site.  Once that was fixed and running for two weeks, the main data center was upgraded.

With as many people as you have behind your UTM, I'm amazed that your reseller didn't get you on Hot-Standby and configured to reserve a node when applying Up2Dates.  Again, standard practice for professionals that know what they're doing.  I don't reserve a node on my clients' High Availability UTMs since I never tell them to Up2Date until I know it's safe.

Cheers - Bob

In the other, active 9.5 thread, Steve Hart reports:

"The patch seems to have solved the SSO issue.

"Their internal tracking number on this issue was NUTM-7960. "

Cheers - Bob

I recently had a Firewall in HA fail. During the RMA process I specified my Required Firmware as 9.4.14-2 and was advised against upgrading to 9.5 because of these known bugs. I recieved my new UTM Monday and low and behold it was preloaded with 9.501-5 . Someone at Sophos dropped the ball.

"The patch seems to have solved the SSO issue."

Great but how do we get hold of it when Sophos don't reply to emails and fob you off on the phone

We had 2 SG135 UTMs die within 3 days.  One running 9.501 and 9.414.  We also asked for 9.414 or earlier, but they installed 9.501.  Very disappointing that they would roll out 2 horrible updates and then wait so long to roll out a fix...while still rolling out the broken updates.

TCF, in the past, we've seen plenty of issues with Up2Dated UTMs that did not occur on fresh installs.  If you want to experiment, try the following:

1. On the 'Hardware' tab of 'Interfaces', set Virtual MACs to equal the real MACs for the NICs in use.
2. Create a config backup and download it to a FAT32 USB memory stick.
3. Insert the USB stick into the new 9.501 SG and boot it.  It will upgrade the 9.414 configuration as it imports it.
4. Power down the 9.414 SG and move the cables to the new one.
5. Check to see if you're having the SSO problem others are seeing.

If that works with no problems, you're left with the choice of reimaging the 9.414 box with a new 9.501 ISO and losing your logs and reporting or re-imaging the new 9.501 unit with 9.414.  My choice would be the latter.  If you do notice any problems related to Active Directory in 9.414, the one-time fix in the following should get you back to normal: Sophos UTM: Httpproxy with AD-SSO authentication doesn't work with Internet Explorer and Chrome after upgrading to 9.5

Cheers - Bob

In the USA, an end user with Premium Support should email utm-premium@Sophos.com. An end user without should email/call their reseller.

In Europe, as I understand it, the first step for a reseller to get a case open with Sophos Support is to email their distributor, but an end user with Premium Support can email Support directly.

Never call any support for any IT issue unless you have a separate support contract of five figures or more.  Always chose email or a web form.

Cheers - Bob

We had the patch applied today, followed the instructions for the post patch actions and now can't get the UTM to rejoin the domain.  Will report back when more fault finding has occured.

Stephen

We had the patch applied today, followed the instructions for the post patch actions and now can't get the UTM to rejoin the domain.  Will report back when more fault finding has occured.

Stephen

Domain join resolved (do not include domain in the Administrator username) and proxy is now functioning normally.

Stephen

Stephen, please show examples of what failed and what worked  - thanks!

Cheers - Bob

Hi Bob,

If i used DOMAIN\Administrator as the account to add the UTM to the domain it would create the computer account but not set the SPN.  If i just used Administrator it then worked OK.  Speaking to a colleage this morning that might be my error, although I'm sure I've done it before.

Stephen