Thread Info
  • Locked Locked
  • Replies 4 replies
  • Subscribers 5 subscribers
  • Views 8181 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM WAF support for back-end servers

DouglasFoster

In the discussion about 9.501-5,  raises the issue that in version 9.501-5, WAF not longer connects to Server 2003 R2, although 9.4 worked.    I assume this is related to cipher suites.

First, this points out the problems with Sophos Release Notes.   They provide cryptic information about the problems that are supposed to be solved, but nothing about the possible implications for us after the changes have been made.  If version 9.Next drops support for back-end servers, it should be explained and highlighted in a context that is hard to miss.

Secondly, WAF products should provide support for legacy back-end servers.   Part of their appeal is their ability to upgrade encryption from the weak protocols on a legacy server to the strong protocols available on the WAF.

Third, it would be appropriate for Sophos to document what systems they have used for testing as back-end servers.

For this particular problem, I wonder if it simplify means that Sophos changed the ciphersuite alow list used for the back-end connection.   In 9.4, it is specified:

  • In directory: /var/storage/chroot-reverseproxy/usr/apache/conf
  • In file:  httpd.conf
  • On these command line:
    SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:ECDH+3DES:DH+3DES:RSA+3DES:!aNULL:!MD5:!DSS
    SSLProtocol all -SSLv2 -SSLv3

This fragment is from my 9.4 system.   It would be helpful for someone to post the equivalent cipher specification for version 9.5.   I wonder if Sophos has disabled TLS1.0 protocol or AES cipher.

 

 



This thread was automatically locked due to age.
Parents

  • Hi Douglas,

    WAF failed vulnerability scans due to TLS 1.0 hence we removed the TLS v1.0 support from v9.4. Support for limiting the minimum TLS version on a per frontend basis is implemented in UTM 9.5. It will be a UI option for the virtual webserver. 

    Cheers-

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Reply

  • Hi Douglas,

    WAF failed vulnerability scans due to TLS 1.0 hence we removed the TLS v1.0 support from v9.4. Support for limiting the minimum TLS version on a per frontend basis is implemented in UTM 9.5. It will be a UI option for the virtual webserver. 

    Cheers-

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Children
  • in reply to sachingurung

    There are two encryption sessions.  The one from clent to WAF needs higher protection than the one from WAF to server. (Internally, the risk of a downgrade attack woulld be the least of my worries).   Vulnerability scans can only see the client to WAF session.

    Configurability is good,  since users without legacy hardware will want maximum protection baked into rhe configuration.  But users with legacy systems will want WAF protection to improve internet session encryption until the legacy hardware can be retired.

  • in reply to DouglasFoster

    Whether you buy my argument or not, administrators need to know when a previously-supported server becones unsupported.  That would begin with some sort of statement about which systems are tested and known to work, tested and knowh to fail, tested and known to work with limitations, or not tested.  It should include announcements abiut encryption changes and how that might affect existing configurations.

    I did not particularly mind when web proxy dropped support for. TLS1.0, but I did mind that it was a surprise.

    In this case, the assertion is that 9.5 broke an existing WAF configuration without warning.  I am not on 9.5 yet, but I do need this information before I upgrade.

  • in reply to DouglasFoster

    Hi Douglas,

    I agree with your statement and yes there is always a prior announcement in the release notes on the changes and fixes. Refer,

    https://community.sophos.com/products/unified-threat-management/b/utm-blog/posts/utm-up2date-9-500-released

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Unfiltered HTML