Upgrade to UTM 9.601-5 firmware doesn't start FW NAT rules on boot

HI Everyone

So glad to see this issue confirmed here - I am NOT going mad after all.  We've had some really big problems with this ; causing us embarrasment and our client's outages

I can confirm the same activity on a few dozen of my UTMS - I am not sure what UTM firmware version this started with but I've seen it for a month or two at least. After a UTM reboot I need to DISable / ENable the NAT rules to get inbound NAT traffic started again. Not always ALL NAT rules it seems, can be just one rule out of dozens - I am now so scared to update firmware or reboot it's silly,  as I need to try every NAT rule after a reboot and I have so many UTMs to do this on. 

Last post on this thread was Jun 7th - any updates from anyone yet?

Thanks

Grant AU

Hi Grant - welcome to the UTM Community!

You might want to use the trick I outlined in April when this phenomenon first appeared.  If the issue only occurs at reboot, use "@reboot" instead of "0 4 * * *" in the cron jobs.

Cheers - Bob

I have now, it does seem to work!

This bug might confuse a lot of people, and actually break things meanwhile. It seems silly something like this can drag on for a couple of updates...

Checking in to confirm that the problem still exists for me as well in 9.605-1

BAlfson: if guess that the cron job is just is a workaround for now? I mean this is not an official solution? I would like to avoid to do such things on my appliance.

Daniel Huhardeaux: did you apply BAlfson solution before updating last firmware? Or was the problem solved by just updating the firmware?

I will try the new firmware in 10 days and will give you my feedback once it's done.

DeltaSM said:

Daniel Huhardeaux: did you apply BAlfson solution before updating last firmware? Or was the problem solved by just updating the firmware?

I didn't apply BAlfson solution, just upgraded and it gone. I will upgrade another UTM this week-end and see if problem disappear too.

Daniel

I don't know if this is in any Sophos KB article or post by a Sophos employee.  I came up with this workaround on my own.

I note that this issue isn't listed under Bugfixes in the information about 9.605.

Cheers - Bob

Daniel Huhardeaux said:

I didn't apply BAlfson solution, just upgraded and it gone. I will upgrade another UTM this week-end and see if problem disappear too. 

On another system problem is still existing.

Daniel Huhardeaux said:

just installed 9.605-1 and problems disappears.

I restarted the UTM to check if effectively problem is gone: is not :( I had again to deactive/active each rule ...

Same here, issue still persists after latest update. Does sophos even care abount fixing this crap issue?

Hi all,

this morning I got answer from Sophos France support: working on our logs they found the problem which should be resolved with version 9.7 expected current october. (!)

Daniel

Daniel Huhardeaux said:

this morning I got answer from Sophos France support: working on our logs they found the problem which should be resolved with version 9.7 expected current october.

9.7 seems to be pre-release ; I cant find an English readme or bugfix 

Has anyone with access to 9.7 got confirmation on whether this is fixed yet - I have dozens of UTMs ready for updates but I am unwilling to update them if I then need to login to each one manually and STOP/START NAT Rules!   

Daniel Huhardeaux said:

this morning I got answer from Sophos France support: working on our logs they found the problem which should be resolved with version 9.7 expected current october.

9.7 seems to be pre-release ; I cant find an English readme or bugfix 

Has anyone with access to 9.7 got confirmation on whether this is fixed yet - I have dozens of UTMs ready for updates but I am unwilling to update them if I then need to login to each one manually and STOP/START NAT Rules!   

Sophos seem to have acknowledged it in KB Article 134544 :

https://community.sophos.com/products/unified-threat-management/f/network-protection-firewall-nat-qos-ips/114764/sophos-notification-nat-rules-might-stop-working-after-rebooting-the-firewall-under-specific-circumstances

I can confirm not fixed in 9.700-5

Thanks for the feedback.

I guess I will have to do it manually for a while again...

Regards,

DeltaSM

If you don't want to wait till a solution is published you can set yourself FW rules and disable the "automatic create fw rules" switch.

Daniel

Daniel - thanks for that info - I wasn't aware you could do that - I may need to do that to some of the clients who seem to need to reboot their UTM often (usually to get 4G USB Dongles to "reconnect") - but doing this to all my client devices will take hours and is just not possible.   Sophos should fix this. 

Grant

Salut Daniel,

Are you saying that the issue is the automatic firewall rule?  Do you see a default drop in the Firewall log (the KB article is misleading for the reasons I mention in the ?  If you look at the automatic rule on the 'Firewall' 'Rules' tab, does everything seem to be correct?  At the command line, is the 'status' of the rule 1?

Cheers - Bob

Hello Bob,

yes, on automatic FW rules and yes, everything is OK in the 'Rules' tab (remember, it was working before I opened this thread connected to the 9-601-5 upgrade).

This WE I upgraded an software UTM to 9.7-5 and problem disappears. Only thing is that after startup, it takes few minutes before rules are applied. I will check on the others I have not yet upgraded to confirm this.

Daniel

Daniel Huhardeaux said:

This WE I upgraded an software UTM to 9.7-5 and problem disappears. Only thing is that after startup, it takes few minutes before rules are applied. I will check on the others I have not yet upgraded to confirm this.

I understand what happends: problem is NOT solved and there is no delay. To get it work you only need to disable/re-enable one rule and automagically all others are applied ! Doesn't matter which one you treat.

Daniel

Hello Daniel,

I've just updated my Sophos routers with firmware 9.700-5 and the problem is not solved.

My worries is about NAT and FW rules that do not impact users behaviour directly who usually come to me to point out a malfunction. I mean ports like Pyzor, Razor, Spamassassin, ... that may be inactive and do not block the use of services but, in this example, takes my mail server out of date.

I have so many rules and routers that I should disable/enable each of them to be sure none remain enabled but inactive.

Saïd

SAID NIAZI said:

I have so many rules and routers that I should disable/enable each of them to be sure none remain enabled but inactive.

As I ponted in my previous message, no need to go over each rule: disabling/enabling just one of them and all is good.

Daniel