Sophos UTM: Decommissioning of obsolete URL categorization services CFFS. Click here for important info.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Upgrade to UTM 9.601-5 firmware doesn't start FW NAT rules on boot


I got information from my UTM that a new firmware 9.601-5 was available. I installed it and after reboot I discover that all my NAT rules where not activated ! I had to go on each one and disable/enable them to get back the working setup :(

I did it with some of them and then reboot the UTM: again rules where not applied. Disable/enable them and evrything is OK.

For some rules I didn't apply the "automatic firewall rules" in GUI but had create myself the FW rules: those NAT rules where activated. But for NAT rules with forwarding ports to other physical hosts but *not the host himself and the VMs running on it where the UTM lies* doesn't matter which setup (manual or automatically), I have to activate "automatic FW rules" and disable/enable the rules to get them working.

No need to say that prior firmware versions didn't had this problem.

Does anyone face the same problem and confirm?


This thread was automatically locked due to age.
Parents Reply
  • Daniel Huhardeaux said:
    This WE I upgraded an software UTM to 9.7-5 and problem disappears. Only thing is that after startup, it takes few minutes before rules are applied. I will check on the others I have not yet upgraded to confirm this.

    I understand what happends: problem is NOT solved and there is no delay. To get it work you only need to disable/re-enable one rule and automagically all others are applied ! Doesn't matter which one you treat.


  • Hello Daniel,


    I've just updated my Sophos routers with firmware 9.700-5 and the problem is not solved.

    My worries is about NAT and FW rules that do not impact users behaviour directly who usually come to me to point out a malfunction. I mean ports like Pyzor, Razor, Spamassassin, ... that may be inactive and do not block the use of services but, in this example, takes my mail server out of date.

    I have so many rules and routers that I should disable/enable each of them to be sure none remain enabled but inactive.


  • SAID NIAZI said:

    I have so many rules and routers that I should disable/enable each of them to be sure none remain enabled but inactive.


    As I ponted in my previous message, no need to go over each rule: disabling/enabling just one of them and all is good.