UTM 9.601 - RED issues!

Do you mean going back to 9.510, Toni?  Won't that old backup have old, incorrect unlock codes requiring deleting and re-installing the REDs?

Cheers - Bob

Hi John Holliday and RedVision81 

Would it be possible to please raise a support case (if you haven't raised one already) and PM me with your case ID's?

It seems that both of your issues are related to RED 15's and UTM v9.605.

I would like to follow up so that further investigation can be performed.

Regards,

Hey FloSupport no we haven't raised one yet, because i have to go via partner first, and i think the problem is still the same, doesnt matter which RED Device.

We had the issues before with a RED10 and two RED50. One of the RED50 is bricked now the others just wont come back online. Then we bought 3 new RED15 and replaced them all in advance, because we need to have a working connection to our remote offices.

Now the same problems are back. This is very frustrating! As i already have written the next RED15 Device just stopped working today after 9 days being up. I tried the workounds again but it doesnt come back online. Checked the Router in the office and it says the RED15 is not connected anymore. Rebooted the Router and later the ethernet connection from the RED15 to the router came back, but the RED is not connecting to our UTM. Finally i deleted the RED15 in the UTM, after a 10 minutes break i added it again, but it is still offline. The last one yesterday needed 3 hours to reconnect after adding it to our SG310 Rev2,. We replaced the SG310 due to the Hardware Refresh Program on 7th august 2019, the SG310 had 9.509-3 out of the box installed. We updated directly to 9.605-1 and then restored our backup from the SG310 Rev.1 because we were already running 9.605-1

Glad there is no one at the office till monday, but this is truely not a condition where we want and of course can deal with.

We have been using these three RED Devices for more than 5 years now, and we never had any issues. But now the RED devices are unreliable for us, also the management at the remote offices and the board of the headquarter is very unhappy with this situation. 

Now we need to get an alternative, maybe a SG115 with Network Protection in RED-Mode or an SG115 with FullGuard working as a standalone firewall. But who is paying the additional costs, who is paying the time we already spent investigating all these issues and dealing with workounds which sometimes work and sometimes not. And what about the brand new RED15 Devices, i cant return them because they are used now, hence i would have three paper weights then!

The Thread here started in March 2019, and its quite a pity that half a year later the problem is still not fixed! The Update to Version 9.605-1 is also out several weeks now, and there is no information from sophos whats going on here, and when a fix or a new version will be available. 

The first location was down 17 hours and 47 minutes

The second location was down 17 hours and 55 minutes

It came back online today morning 08:06 am

Now at 08:20 I just received a mail from our monitoring the third location is down!!!!

Slowly but surely I think it's more a big issue with the provisioning service / servers, because when I make changes the red does not reconnect immediately, neither when I delete the RED and add it back again there is no activity shown, just the usual upload config and staging messages.

Let's see if the third location will be back in 17 hours....

To be continued....

I would highly suggest to start to debug your UTM Connection.

Start by dumping the Port 3410 and Port 3400 Port in a file (ring buffer) and extract it. 

Then analyse the time frame, when the connection drops and not restart. 

I would guess, this is, as mentioned before, not related to the general RED issue in UTM9.6.

https://community.sophos.com/kb/en-us/134398

Maybe you should open another Channel and post your output there. 

I can also confirm, that we could solve overflow issues on RED15W with disabling the unified firmware. Customer had recurring interuptions. This has really nothing to do with ISPs.... It´s the really bad quality of your software, that isn´t tested sufficiently and causes so many headaches to many customers... You should really think about rolling out security and feature updates seperatly. So someone could still satisfy security needs, while features could be installed later...

And what we get know after disabling the unified firmware is this message:

[INFO-184] RED server not running - restarted

It appears every hour...

Plan a reboot, that fixed the issue here....

If HA reboot both nodes.

Thank you, we will try that!