Forum for HA and Autoscaling UTM deployments @ AWS?

hi, any update on this ? im interested in this feature on AWS.

thanks

P.

I've been trying this for few weeks as well.  

Apparently, the firmware upgrade within UTM does not do anything for HA/Autoscaling.  It's basically UTM software patch(eg. Windows security patch vs Windows Service Pack).  What has to happen is that you have to download entirely new AMI version(9.4x) from AWS marketplace and reconfigure the new instance from scratch.  or use backup to reload your configurations.  Which it kind of sucks because, it requires more work than just simple upgrade.  

Sophos is really behind on their contents on this matter.  Their template is pointing to the wrong AMI version(9.3x) so you have to manually change that first and their instructions is wrong as well.  

Hi LeoKim,

Thanks for your feedback. We're still working out some kinks with our conversion utility, but once finished you shouldn't have to reconfigure the new instance from scratch. We're also creating a process that will automatically update all our CloudFormation templates so you have the most recent AMIs.

I'd be interested in hearing your feedback so we can create a better product and process for our customers. If you can, please reach out to aws.marketplace@sophos.com to schedule some time with me.

Thanks again.

Rich Vorwaller

Product Manager, Sophos IaaS

So yesterday I finally upgraded one of our UTMs to the newest 9.407-3 version.  I thought I would investigate this conversion utility further since the last time I looked at it was July (see above in this thread).   One would logically think that if including it prematurely before was a mistake (again, see earlier in this thread), if they hadn't removed it in the intervening versions then presumably they fixed/finished the functionality.

Nope :(

Unexpected error in aws_convert_to_deployment: No such file or directory at /usr/local/ap510/site/lib/IPC/Run3.pm line 426.

To me, that just seems sloppy and unprofessional to not only have a much touted feature fail, but fail in such an ugly way.  So I opened a support case and was told:

"There will be an upcoming release to address the below source for the error message.  
Other alternatives are deploy using a Cloud formation template for either a HA or AS configuration. "

So basically, despite the fancy UI, this feature is still completely unusable and the only option is to hack around with CF templates and try to get something working that way... last I checked though, the CF templates provided created a whole new VPC (https://community.sophos.com/kb/en-US/122742) so that's not really much of an option for dealing with an existing environment that you want to upgrade.

If this were a free piece of software created by volunteers then I could understand this, but how does a supposedly "Enterprise" piece of commercial software get released with such a glaring flaw?

Hi lprikockis,

Thanks for your feedback. Completely understand your frustration. As we mentioned in a previous post, the UI utility was released prematurely. To remove it would have caused some additional problems for the release, so we decided to leave it in as with the message that is was not yet available. However, no excuses. We want to provide a better experience for our customers, and appreciate your points. We're working on getting this fixed in our next release.

Can you email us your support case ID? I'd like to review the case and possibly your logs to make sure our next release will indeed address the problem you reported. Please reach out to aws.marketplace@sophos.com.

Thanks again.

Rich Vorwaller

Product Manager, Sophos IaaS

Hi lprikockis

I am part of the development team working on this feature at Sophos.

Could you please provide us with the confd.log (Configuration Daemon) of the time you tried the conversion and the error message appeared?

Unfortunately we have have not published the update path yet, but we are working on that at the moment.

Would you also be interested in doing kind of a beta tester for it?

Hi lprikockis

I am part of the development team working on this feature at Sophos.

Could you please provide us with the confd.log (Configuration Daemon) of the time you tried the conversion and the error message appeared?

Unfortunately we have have not published the update path yet, but we are working on that at the moment.

Would you also be interested in doing kind of a beta tester for it?

no problem... happy to provide the confd.log file and I'd also be willing to be a beta tester of this feature... I definitely would love to see it working.

Hi lprikockis

Good news. We can reproduce your problem. Thanks a lot for the confd.log.

You are running a "Auto Scaling" ami (image name starts with something like axg9400_aws-asg-9.406)?

The conversion feature is only supported for our standalone ami.

So try to launch one of those:

https://aws.amazon.com/marketplace/pp/B00DJDRZB2

And the error message should be gone (instead you will get the message saying there is no update path yet).

If you reach that step, please PM me and I will give you instructions on how to use the conversion as a beta user.

Thanks a lot for your help, and discovering this bug

Hmmm... I'm not sure what AMI it is since all I get from AWS is:   "Cannot load details for ami-3ec9a957. You may not be permitted to view it."

However, this particular instance was first launched in December 2014, so I doubt it was the auto-scaling AMI as that didn't exist at the time.

When I have a moment, I'll try launching a standalone instance in a test VPC and confirm that I get the appropriate message.

I seems like what this is pointing to is the fact that folks with older versions that have been upgraded to the latest firmware without a completely new relaunch from a recent AMI may not be able to use this "automated" conversion path.   So if I need to launch an entirely new instance, shouldn't there be some way to just launch the HA version in my current VPC and then load the saved configuration?    It seems a little weird to have to create a "new" standalone AMI UTM just for the purpose of "automatically" converting it to the HA version.

Can you provide us the output of 'version' in bash?

The idea of conversion is to convert single instances into HA or Auto Scaling setups. In your case you already have a Auto Scaling setup (probably spawned without CloudFormation and only one instance), so there is no need to use the conversion right there.

loginuser@qcpfw:/home/login > version

Current software version...: 9.407003
Hardware type..............: Software Appliance
Installation image.........: 9.000-8.1
Installation type..........: asg
Installed pattern version..: 111918
Downloaded pattern version.: 111918
Up2Dates applied...........: 59 (see below)
sys-9.000-9.001-8.18.1.tgz (Mar 6 2013)
sys-9.001-9.002-18.12.1.tgz (Mar 6 2013)
sys-9.002-9.003-12.15.1.tgz (Mar 6 2013)
sys-9.003-9.003-15.16.4.tgz (Mar 6 2013)
sys-9.003-9.004-15.33.1.tgz (Mar 7 2013)
sys-9.004-9.004-33.34.1.tgz (Mar 25 2013)
sys-9.004-9.005-29.15.2.tgz (Mar 25 2013)
sys-9.005-9.005-15.16.1.tgz (Mar 25 2013)
sys-9.005-9.006-15.5.2.tgz (Apr 5 2013)
sys-9.006-9.100-5.16.1.tgz (May 13 2013)
sys-9.100-9.101-16.12.1.tgz (Jun 13 2013)
sys-9.101-9.102-11.8.2.tgz (Aug 9 2013)
sys-9.102-9.103-8.5.2.tgz (Aug 19 2013)
sys-9.103-9.104-5.17.2.tgz (Aug 19 2013)
sys-9.104-9.105-17.9.1.tgz (Sep 3 2013)
sys-9.105-9.106-9.17.1.tgz (Nov 4 2013)
sys-9.106-9.107-17.33.2.tgz (Mar 9 2014)
sys-9.107-9.108-33.23.2.tgz (Mar 9 2014)
sys-9.108-9.109-23.1.2.tgz (Mar 9 2014)
sys-9.109-9.110-1.22.1.tgz (Apr 10 2014)
sys-9.110-9.111-22.7.1.tgz (Apr 10 2014)
sys-9.111-9.111-7.11.1.tgz (May 28 2014)
sys-9.111-9.112-7.12.1.tgz (Jun 26 2014)
sys-9.112-9.113-12.1.2.tgz (Jun 26 2014)
sys-9.113-9.203-1.3.1.tgz (Aug 7 2014)
sys-9.203-9.204-3.20.1.tgz (Aug 7 2014)
sys-9.204-9.205-20.12.1.tgz (Dec 17 2014)
sys-9.205-9.206-12.35.1.tgz (Dec 17 2014)
sys-9.206-9.207-35.19.2.tgz (Dec 17 2014)
sys-9.207-9.208-19.8.5.tgz (Dec 17 2014)
sys-9.208-9.209-8.8.1.tgz (Dec 17 2014)
sys-9.209-9.210-8.20.1.tgz (Dec 17 2014)
sys-9.210-9.304-20.9.2.tgz (Dec 18 2014)
sys-9.304-9.305-9.4.1.tgz (Dec 18 2014)
sys-9.305-9.306-4.6.1.tgz (Feb 5 2016)
sys-9.306-9.307-6.6.1.tgz (Feb 5 2016)
sys-9.307-9.308-6.16.2.tgz (Feb 6 2016)
sys-9.308-9.309-16.3.1.tgz (Feb 6 2016)
sys-9.309-9.310-3.11.1.tgz (Feb 6 2016)
sys-9.310-9.311-11.3.1.tgz (Feb 6 2016)
sys-9.311-9.312-3.8.1.tgz (Feb 6 2016)
sys-9.312-9.313-8.3.1.tgz (Feb 6 2016)
sys-9.313-9.314-3.13.1.tgz (Feb 6 2016)
sys-9.314-9.315-13.2.1.tgz (Feb 6 2016)
sys-9.315-9.316-2.4.1.tgz (Feb 6 2016)
sys-9.316-9.317-4.5.1.tgz (Feb 6 2016)
sys-9.317-9.318-5.5.2.tgz (Feb 6 2016)
sys-9.318-9.350-5.12.1.tgz (Feb 6 2016)
sys-9.350-9.351-12.3.2.tgz (Feb 6 2016)
sys-9.351-9.352-3.6.2.tgz (Feb 6 2016)
sys-9.352-9.353-6.4.1.tgz (Feb 6 2016)
sys-9.353-9.354-4.4.1.tgz (Apr 7 2016)
sys-9.354-9.355-4.1.1.tgz (Apr 7 2016)
sys-9.355-9.356-1.3.1.tgz (Oct 25 03:03)
sys-9.356-9.357-3.1.4.tgz (Oct 25 03:04)
sys-9.357-9.404-1.5.3.tgz (Oct 25 03:09)
sys-9.404-9.405-5.5.1.tgz (Oct 25 03:11)
sys-9.405-9.406-5.3.1.tgz (Oct 25 03:12)
sys-9.406-9.407-3.3.1.tgz (Oct 25 03:15)
Up2Dates available.........: 0
Factory resets.............: 0
Timewarps detected.........: 0

Thanks. I tried to reproduce your problem but for me everything works.

The update path you went through looks valid.

Did you do any modification to the machine like doing file manipulation in bash or manual patching?

Good news:

We have identified the problem (basically there is no valid update path for the conversion feature with pretty old versions as yours).

We are working on a fix and will release it with 9.408.

Good news:

We have identified the problem (basically there is no valid upgrade path for the conversion feature with pretty old install versions as yours).

We fixed this and it will be released with 9.408.

So all you will have to do, as soon as 9.408 is release, is to upgrade and the conversion feature should work as intended for you.

Thanks for finding and reporting this issue.

great... nothing like being "punished" again for being an early adopter of the UTM @ AWS :(  

Glad to hear there's finally a fix coming though.  Better late than never I suppose.

I just upgraded to version Firmware version: 9.408-4  Pattern version:112573

I have a single AWS Sophos UTM installed in one VPC the above error is what I get when trying to click