UTM 9.601 - RED issues!

RE: UTM 9.601 - RED issues!

RedVision81 — Wed, 15 Jul 2020 06:43:21 GMT

with 9.703-3 we have bin told to use unified firmware

-> cc set red use_unified_firmware 1

is it also still necesseary leaving the MTU to 1400 ?

RE: UTM 9.601 - RED issues!

Alexander Busch — Tue, 14 Jul 2020 20:06:21 GMT

[quote user="Bruno Schley"]

...
Before I start another test I asked them to give me more information how that flashing has to be done.
The image has to be copied on a memory stick and then you have to flash it in a console session.
But... not all memory sticks are compatible....?!?!
I let you know if get the informations...
...
[/quote]

I would be happy too for any news regarding that problem. I cross my fingers, however myself I am on a stable basis with unified firmware 0. But with every update I get a strange feeling.

Best regards

Alex

RE: UTM 9.601 - RED issues!

FormerMember — Tue, 14 Jul 2020 15:45:17 GMT

Hi RedVision81

Apologies for the inconvenience caused.

I'd request you PM me the support case number for further investigation.

Thanks,

RE: UTM 9.601 - RED issues!

RedVision81 — Tue, 14 Jul 2020 06:17:44 GMT

We updated from 9.702-1 to Version 9.703-3 the last days, but the Problems are still not solved!!!
One of our Red15 (which has already been replaced a few month before due to these problems) is facing the same problems again since two weeks now. Also after the update to 9.703-3 the issues are still there.
-connection loss, overflow happen, etc. etc. it also generates tons of emails -> red connection down / up /down / up

The workaround at the moment is, disable the red and the appropriate interface, wait 5 to 10 minutes and enable it again. the red comes up, but it only lasts 2 - 3 days till the problem comes back.

Flashing the REDs manually with a new Image? Seriously, this cant be a solution for a lot of customers out there.

RE: UTM 9.601 - RED issues!

Bruno Schley — Fri, 10 Jul 2020 06:42:55 GMT

Good morning Aaron,

yesterday I had a telephone conference with a distributor and his sophos techician.
They told me that Sophos is going to solve the problem with 9.703-3 but still you have to have to get hands on it.
Sophos published an image for RED´s and you have to flash the RED`s with it.
And in combination with 9.703-3 the RED`s should be stabel.
Before I start another test I asked them to give me more information how that flashing has to be done.
The image has to be copied on a memory stick and then you have to flash it in a console session.
But... not all memory sticks are compatible....?!?!
I let you know if get the informations...

Greetings
Bruno

RE: UTM 9.601 - RED issues!

Aaron Leech — Tue, 30 Jun 2020 12:59:40 GMT

Unfortunately I can only speak for our organization.

The RED50 is being replaced by RED60, so you might be able to get those. The RED20 should be good too if it meets your requirements.

You just have to have 9.703 installed to be able to configure either one.

RE: UTM 9.601 - RED issues!

Sophos User287 — Tue, 30 Jun 2020 06:28:25 GMT

Yes and it's still happening..... Only just last week again! I've even got it in balancing mode now and it still dropped out.

Once the 9.703-3 update becomes available for my units I'll deploy and see what happens but suffice to say, the issue still exists in 9.702-1 for us.

RE: UTM 9.601 - RED issues!

Bruno Schley — Tue, 30 Jun 2020 06:12:06 GMT

Hello Aaron,

thanks for your Info.
I´m really thinking about giving it a chance...but....
"Sophos User287" wrote in Mai that he has still the same issues.
Next problem is, the RED50`s are actually not available because of delivery problems.

I could get a RED20....has anyone experiences with it....`?

Greetings
Bruno

RE: UTM 9.601 - RED issues!

Aaron Leech — Fri, 26 Jun 2020 13:25:03 GMT

Knock on wood, our RED50s have been stable since the upgrade to 9.702. Before we were losing 1-2 a week out of the 8 we have deployed.

RE: UTM 9.601 - RED issues!

Bruno Schley — Fri, 26 Jun 2020 08:58:31 GMT

Hello everybody,

can somebody give me an update how the actual situation is about the connection problems, bootloop problems and unified_firmware problems wit RED ?

I was strugeling myself at the end of 2019 with the bootloop problem and I`m still looking for a solution to connect a branch to our main office, using the same IP-range.
I got three RED15 over RMA, but no one worked until I found this post - we gave all of them back but I still have no connection.

In the main office we`re using a SG210 running 9.605-1, but I could update to 9.702-1.

What about the RED 20....same problem...?

Greetings..
Bruno

RE: UTM 9.601 - RED issues!

Sophos User287 — Wed, 06 May 2020 02:58:24 GMT

I'm still getting this also on a RED 50 running 9.702-1.... quite annoying.

RE: UTM 9.601 - RED issues!

assistenzainterna — Wed, 06 May 2020 01:46:25 GMT

Moved the RED15 from our office in Italy to a customer in Austria.

Got

SELF: Cannot do SSL handshake on socket accept from 'x.x.x.x': SSL connect accept failed because of handshake problems

Reading the post, I'll try cc set red use_unified_firmware 0 and MTU 1400 tricks.

Let's see tomorrow...

Good night Sophos. It seems you're in trouble.

RE: UTM 9.601 - RED issues!

Sophos User287 — Fri, 20 Mar 2020 01:01:26 GMT

So all RED's are running 9.702-1 and still seeing this SSL drop issue.

red2ctl[15035]: Overflow happened

SELF: Cannot do SSL handshake on socket accept from 'x.x.x.x': SSL connect accept failed because of handshake problems

Honestly...

RE: UTM 9.601 - RED issues!

KlausHahn — Mon, 16 Mar 2020 12:45:42 GMT

Hi,

what is the current recommend Setting with UTM Firmware 9.702-1 ?

cc set red use_unified_firmware = 0

cc set red use_unified_firmware = 1

Thanks,
Klaus

RE: UTM 9.601 - RED issues!

twister5800 — Thu, 12 Mar 2020 12:55:54 GMT

yes tried and seen exactly that on 5 devices :-O

RE: UTM 9.601 - RED issues!

ChrisBKA — Thu, 12 Mar 2020 11:03:04 GMT

..oh wow ... after enabling the tunnel compression and disabling it again, the firwareupdate on the red started... maybe now there will be success ?

keep you posted...

UPDATE:

After 4 reboots the device is finally up ...

RE: UTM 9.601 - RED issues!

ChrisBKA — Thu, 12 Mar 2020 10:58:44 GMT

Hi Jan,

after upgrading to 9.702-1 on UTM the RED device ist again in bootloop.

Only difference: it is now tring to connect to UTM

2020:03:12-11:44:29 firewall red_server[13446]: SELF: Cannot do SSL handshake on socket accept from '<public IP adress>': SSL connect accept failed because of handshake problems
2020:03:12-11:44:35 firewall red_server[13478]: SELF: New connection from <public IP adress> with ID <RED-ID> (cipher AES256-GCM-SHA384), rev1<30>Mar 12 11:44:35 red_server[13478]: <RED-ID>: connected OK, pushing config
2020:03:12-11:44:36 firewall red_server[13478]: <RED-ID>: command '{"data":{"version":"0"},"type":"INIT_CONNECTION"}'
2020:03:12-11:44:36 firewall red_server[13478]: <RED-ID>: Initializing connection running protocol version 0
2020:03:12-11:44:36 firewall red_server[13478]: <RED-ID>: Sending json message {"data":{},"type":"WELCOME"}
2020:03:12-11:44:38 firewall red_server[13478]: <RED-ID>: command '{"data":{},"type":"CONFIG_REQ"}'
2020:03:12-11:44:38 firewall red_server[13478]: <RED-ID>: Sending json message {"data":{"pin":"","fullbr_dns":"","split_networks":"1.2.3.4","lan2_vids":"","lan4_vids":"","local_networks":"","tunnel_id":2,"manual2_netmask":24,"asg_cert":"[removed]","manual_address":"0.0.0.0","bridge_proto":"none","unlock_code":"egbbg2nu","password":"","manual2_defgw":"0.0.0.0","prev_unlock_code":"","manual_netmask":24,"lan3_vids":"","version_r2":"2005R2","mac_filter_type":"none","mac":"00:f3:02:11:e7:d0","dial_string":"*99#","manual2_address":"0.0.0.0","version_ng_red50":"1-442-bdae8a94a-0000000","manual_dns":"0.0.0.0","lan1_mode":"unused","username":"","activate_modem":0,"tunnel_compression_algorithm":"lzo","version_red50":"1-442-bdae8a94a-0000000","fullbr_domains":"","htp_server":"<fqdn>","uplink_balancing":"failover","asg_key":"[removed]","type":"red50","deployment_mode":"online","uplink2_mode":"dhcp","version_red15":"1-433-2023f2ad6-e9f0c31","manual2_...L1504
2020:03:12-11:44:38 firewall red_server[13478]: <RED-ID>: command '{"data":{"message":"Firmware update required. Trying provisioning service ..."},"type":"DISCONNECT"}'
2020:03:12-11:44:38 firewall red_server[13478]: <RED-ID>: Disconnecting: Firmware update required. Trying provisioning service ...
2020:03:12-11:44:38 firewall red_server[13478]: id="4202" severity="info" sys="System" sub="RED" name="RED Tunnel Down" red_id="<RED-ID>" forced="1"
2020:03:12-11:44:38 firewall red_server[13478]: <RED-ID> is disconnected.

Further I discovered that the RED is displaying WAN2 as WAN1 and WAN1 as WAN2

So if you have plugged in WAN1 and try to display ip adress of WAN1 then the display gives N/A

However if you let the RED show you the ip adress of WAN2 the ip provided by DHCP is displayed...

Now I am currently in the german 'Warteschleife für UTM' and i try not to break my phone.

I was so happy that you finally fixed the problems your devs produced and now there is the next glitch ?

WTF SOPHOS

RE: UTM 9.601 - RED issues!

DasSchreckliche Wiesel — Fri, 06 Mar 2020 10:51:01 GMT

worked for 21 of 22

RE: UTM 9.601 - RED issues!

Aaron Leech — Thu, 05 Mar 2020 15:05:57 GMT

We were fortunate and didn't lose any REDs in the upgrade process.

Hopefully this is isolated, but our upgrade process failed partway through though, and left one of the nodes stuck in up2date mode. Apparently the primary node somehow lost the file and was unable to complete the update when its turn came up.

It took a bit of doing to get the file on the passive node so it could complete, but we're back now.

I just hope this resolves the RED issues for good, I'm going to be skeptical of these things for a while now.

RE: UTM 9.601 - RED issues!

ButtonPuncher — Thu, 05 Mar 2020 14:42:32 GMT

Yep! Watch out! I experienced the same thing as twister5800. I updated to 9.702 last night, one RED50 updated successfully, the other one died. The one that died was already acting odd. It had a few disconnects over the last couple of weeks even though the connection (fiber) never had an outage.

The one that died was only put in to service on 1-16-2020. So it wasn't like it was a really old RED50. It was an RMA replacement with a mfg date of July of 2019.

BTW, this is dead RED50 number 7 for me. Aren't I lucky? Hopefully this disaster is finally over.

Thanks,

RE: UTM 9.601 - RED issues!

twister5800 — Thu, 05 Mar 2020 11:58:01 GMT

Hi Jan,

Thanks for explaining - it's off-topic here, but I cannot seem to find anywhere how to switch XG to unified firmware, even if I deploy a whole new Xg 18, it's deployed with the legacy firmware?! - It's kinda odd.

One other thing.

When upgrading to 9.702-1, if a RED 50 is already so "bad" in shape with the flash file structure, it bricks when you upgrade to 9.702.

I upgraded 36 UTM's yesterday and two RED 50's from 9.701 died after moving to 9.702. So watch out and plan carefully!

RE: UTM 9.601 - RED issues!

JanWeber — Wed, 04 Mar 2020 14:02:40 GMT

Hi Martin,

not all XG installations are running on the unified firmware, so it is expected that the new pattern would not install a new firmware on the RED50 in all cases when it comes to XG.

So nothing to worry here, if your XG connected RED50 is not installing a new firmware you are not on the unified firmware and there is no change needed. If you would have been on the unified firmware the RED50 would have updated.

Jan

RE: UTM 9.601 - RED issues!

FloSupport — Wed, 04 Mar 2020 02:04:22 GMT

Hi garth1138

Followed up with the team to confirm the behavior.

Users who are upgrading and are currently on the legacy firmware will not be forced onto the unified firmware (at the moment).

Regards,

RE: UTM 9.601 - RED issues!

twister5800 — Tue, 03 Mar 2020 12:20:44 GMT

Further funny evidence :-O

RE: UTM 9.601 - RED issues!

twister5800 — Tue, 03 Mar 2020 12:06:13 GMT

Jan, for XG, as posted before, I wrote that I think XG is not running the Unified Firmware as 9.702 does, and I have noticed that when I on Xg run firmware 2.0.18 and upgrade to 2.0.19 the firmware revision doe snot change, nor does the RED 50 perform firmware upgrade, it just reconnects, here is the log from the XG, is this intetionally ?!?! or an error:

Firmware 2.0.18

Wed Feb 19 12:50:57 2020 REDD INFO: server: Using RED firmware in /content/redfw/
Wed Feb 19 12:50:57 2020 REDD INFO: server: RED10 fw version set to 10224R2
Wed Feb 19 12:50:57 2020 REDD INFO: server: RED15(w) fw version set to 10224
Wed Feb 19 12:50:57 2020 REDD INFO: server: RED50 fw version set to 10224

Firmware 2.0.19

Tue Mar 3 12:58:55 2020 REDD INFO: server: RED10 fw version set to 10224R2
Tue Mar 3 12:58:55 2020 REDD INFO: server: RED15(w) fw version set to 10224
Tue Mar 3 12:58:55 2020 REDD INFO: server: RED50 fw version set to 10224

?!?!?