Thread Info
  • State Suggested Answer
  • +4 person also asked this people also asked this
  • Locked Locked
  • Replies 62 replies
  • Answers 2 answers
  • Subscribers 13 subscribers
  • Views 72955 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Upgrade to UTM 9.601-5 firmware doesn't start FW NAT rules on boot

Daniel Huhardeaux

Hi,

I got information from my UTM that a new firmware 9.601-5 was available. I installed it and after reboot I discover that all my NAT rules where not activated ! I had to go on each one and disable/enable them to get back the working setup :(

I did it with some of them and then reboot the UTM: again rules where not applied. Disable/enable them and evrything is OK.

For some rules I didn't apply the "automatic firewall rules" in GUI but had create myself the FW rules: those NAT rules where activated. But for NAT rules with forwarding ports to other physical hosts but *not the host himself and the VMs running on it where the UTM lies* doesn't matter which setup (manual or automatically), I have to activate "automatic FW rules" and disable/enable the rules to get them working.

No need to say that prior firmware versions didn't had this problem.

Does anyone face the same problem and confirm?

Daniel



This thread was automatically locked due to age.
Parents
  • 0

    Daniel Huhardeaux said:

    [...] But for NAT rules with forwarding ports to other physical hosts but *not the host himself and the VMs running on it where the UTM lies* doesn't matter which setup (manual or automatically), I have to activate "automatic FW rules" and disable/enable the rules to get them working.

    This point is solved, I did a mistake in my FW rules for those destinations, sorry for the noise.

    Daniel

     

  • 0 in reply to Daniel Huhardeaux

    Hello Daniel,

    I have the same problem and it's pretty annoying. Did you have any feedback about this?

    Regards,

    DeltaSM

  • 0 in reply to BAlfson

    Hi Bob,

    we could but this problem appears on at least 3 of UTM including physical one. On a fourth one I removed the automatic fw rules and create them manually. But hey, if the feature exist, it should work ;)

    Also, my partner which opened the case in France face the same problem with few of their UTM. I don't think it's a rare case ...

    Daniel

  • 0 in reply to Daniel Huhardeaux

    Yeah, I've seem this too on the two installs I updated to 9.602-3 for testing its stability. It's too wide to be something isolated. I think we hit a bug there. 

  • 0 in reply to giomoda

    Thank you for feedback guys :)

    It seems obvious that there is a problem now.

  • 0 in reply to DeltaSM

    : I see you often answer in all the topics of this forum? Do you work at Sophos? Can you tell us if a case is actually open for this issue?

    Does anyone have any status of this?

    Regards,

    DeltaSM

  • 0 in reply to DeltaSM

    Daniel said above that his partner opened a case in France.  I'm sure there must be a NUTM for this.

    No, I'm not a Sophos employee, but thanks for asking!  We justify my participation here as marketing.  It's rewarded me with Sophos customers all across North America and additionally with consulting clients on three other continents - including other Sophos resellers.  I worked in IT in Germany in German (1 year) and in France in French (5+ years), so I especially enjoy those interactions.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hello Bob,


    Wow nice :) I would like to thank you because you often helped me once I opened a case ! Thank you for your contribution !

    : des nouvelles de Sophos? Le cas de support avance-t-il?

    Regards,

    DeltaSM

  • 0 in reply to Daniel Huhardeaux

    Has anyone heard back regarding this issue?  I just rolled out 9.603-1 and pretty every one of the firewalls I managed came up with NAT rules not working.  I have to manually turn every rule off and back on... Frustrating and time consuming.

  • 0 in reply to J_Money

    If anyone else has this problem, please try restoring the config backup made before the Up2Date/s was/were applied.  If that doesn't resolve the issue, try a reboot.  Please let us know your results.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Bob, a config restore was one of the first things I tried.  The NAT rules will work until a reboot, at which time I can see the traffic coming in but firewall logs show it blocked by the Default Drop.  When I toggle the rules off and back on they work again.

  • 0 in reply to J_Money

    This may sound totally strange but if you see the problem after a reboot again, try pinging the ip addresses on which the corresponding nat rules are bound and if these are not answering (which i am expecting) try disabling and after 2-3 seconds re-enabling the additional ip addresses and check if they are answering. Then, check if the nat rules are answering (which i expect). Then, reboot again to check if now everything comes up good.

Reply
  • 0 in reply to J_Money

    This may sound totally strange but if you see the problem after a reboot again, try pinging the ip addresses on which the corresponding nat rules are bound and if these are not answering (which i am expecting) try disabling and after 2-3 seconds re-enabling the additional ip addresses and check if they are answering. Then, check if the nat rules are answering (which i expect). Then, reboot again to check if now everything comes up good.

Children
Unfiltered HTML