Upgrade to UTM 9.601-5 firmware doesn't start FW NAT rules on boot

HI Everyone

So glad to see this issue confirmed here - I am NOT going mad after all.  We've had some really big problems with this ; causing us embarrasment and our client's outages

I can confirm the same activity on a few dozen of my UTMS - I am not sure what UTM firmware version this started with but I've seen it for a month or two at least. After a UTM reboot I need to DISable / ENable the NAT rules to get inbound NAT traffic started again. Not always ALL NAT rules it seems, can be just one rule out of dozens - I am now so scared to update firmware or reboot it's silly,  as I need to try every NAT rule after a reboot and I have so many UTMs to do this on. 

Last post on this thread was Jun 7th - any updates from anyone yet?

Thanks

Grant AU

Hi Grant - welcome to the UTM Community!

You might want to use the trick I outlined in April when this phenomenon first appeared.  If the issue only occurs at reboot, use "@reboot" instead of "0 4 * * *" in the cron jobs.

Cheers - Bob

I don't know if this is in any Sophos KB article or post by a Sophos employee.  I came up with this workaround on my own.

I note that this issue isn't listed under Bugfixes in the information about 9.605.

Cheers - Bob

Daniel Huhardeaux said:

I didn't apply BAlfson solution, just upgraded and it gone. I will upgrade another UTM this week-end and see if problem disappear too. 

On another system problem is still existing.

Daniel Huhardeaux said:

just installed 9.605-1 and problems disappears.

I restarted the UTM to check if effectively problem is gone: is not :( I had again to deactive/active each rule ...

Same here, issue still persists after latest update. Does sophos even care abount fixing this crap issue?

Hi all,

this morning I got answer from Sophos France support: working on our logs they found the problem which should be resolved with version 9.7 expected current october. (!)

Daniel

Daniel Huhardeaux said:

this morning I got answer from Sophos France support: working on our logs they found the problem which should be resolved with version 9.7 expected current october.

9.7 seems to be pre-release ; I cant find an English readme or bugfix 

Has anyone with access to 9.7 got confirmation on whether this is fixed yet - I have dozens of UTMs ready for updates but I am unwilling to update them if I then need to login to each one manually and STOP/START NAT Rules!   

Sophos seem to have acknowledged it in KB Article 134544 :

https://community.sophos.com/products/unified-threat-management/f/network-protection-firewall-nat-qos-ips/114764/sophos-notification-nat-rules-might-stop-working-after-rebooting-the-firewall-under-specific-circumstances

I can confirm not fixed in 9.700-5

Thanks for the feedback.

I guess I will have to do it manually for a while again...

Regards,

DeltaSM

If you don't want to wait till a solution is published you can set yourself FW rules and disable the "automatic create fw rules" switch.

Daniel

Daniel - thanks for that info - I wasn't aware you could do that - I may need to do that to some of the clients who seem to need to reboot their UTM often (usually to get 4G USB Dongles to "reconnect") - but doing this to all my client devices will take hours and is just not possible.   Sophos should fix this. 

Grant

Daniel - thanks for that info - I wasn't aware you could do that - I may need to do that to some of the clients who seem to need to reboot their UTM often (usually to get 4G USB Dongles to "reconnect") - but doing this to all my client devices will take hours and is just not possible.   Sophos should fix this. 

Grant