Forum for HA and Autoscaling UTM deployments @ AWS?

hi, any update on this ? im interested in this feature on AWS.

thanks

P.

I've been trying this for few weeks as well.  

Apparently, the firmware upgrade within UTM does not do anything for HA/Autoscaling.  It's basically UTM software patch(eg. Windows security patch vs Windows Service Pack).  What has to happen is that you have to download entirely new AMI version(9.4x) from AWS marketplace and reconfigure the new instance from scratch.  or use backup to reload your configurations.  Which it kind of sucks because, it requires more work than just simple upgrade.  

Sophos is really behind on their contents on this matter.  Their template is pointing to the wrong AMI version(9.3x) so you have to manually change that first and their instructions is wrong as well.  

Zak,

Bill is correct in the above statement. This thread is specifically to address and understand how long current customers on the latest Sophos UTM 9  version 9.408-4  on a AWS with a live production VPC environment have to wait before the  HA deployment feature within the GUI works. This thread is for sophos to report on ETA's report current firmware that address the issue and  issues with HA configurations, I would visit other threads that already answer and address concerns of EIP's and how they move between AWS AZ's.

Any update on the HA release I will have to use cisco or fortnet for my AWS solution if we can not make the HA conversion work. Please let us know timeline ?

Hi Vitale,

We're looking to fix this in 9.409, which is scheduled for the week of December 26. We'll keep you posted when we publish.

Thanks.

Rich thank you for the update will this address the HA GUI deployment

Hi Vitale,

You're welcome. We just pushed 9.409 to the AWS Marketplace today. It will probably take AWS a couple of days to scan the AMIs and publish them. We'll let you know when we hear a date. Once 9.409 is published, the conversion utility for HA should work. We'll follow up in January with a 9.10 release that will support the conversion utility for Auto Scaling.

Let me know if you have any questions. Thanks.

Thank you for the update I went ahead and upgraded the existing firewall, to version  9409 as you can see in my screen shot below but I was unable to complete the HA setup still. Is there a reson why I cant deploy HA after the upgrade? Do i really need to launch a brand new instance from AWS market place first? If so which instance do I need Launch.

Thanks Vitale,

There are two ways customers can update Sophos UTM on AWS. One way is via up2date, which I believe is the method you used. This update path is only available for our Stand Alone (Single AMI) release and uses the normal update process for all UTMs.

Because our Auto Scaling and HA releases uses multiple AMIs, these releases don't update via up2date. Instead we've built a process called Cloud Update which uses CloudFormation stack updates to update the different AMIs. The conversion utility also uses CloudFormation stack updates as the process converts a Single AMI to multiple AMIs (depending on the option you choose). This means that the conversion utility won't work until (1) AWS publishes the latest AMI in the AWS Marketplace, and (2) we've updated our CloudFormation templates with the new AMI IDs (which AWS gives us).

docs.aws.amazon.com/.../using-cfn-updating-stacks.html

Again, we just pushed 9.409 to the AWS Marketplace yesterday. It usually takes AWS a couple of days to scan and publish them, with the holidays it may take a bit more. As soon as AWS comes back with the new AMI IDs, we'll update our templates and then the conversion utility should work. We'll let you know when we hear back from AWS.

Hope that makes sense. If not, ping us via aws.maketplace@sophos.com and we can arrange a call.

Thanks.

Hi.  I have been waiting for these AMIs to publish but it seems like it is taking longer than expected.   Do you have any kind of update on when they will be available?  I'm waiting to deploy a new single instance of 9.409 using HVM so that I can prepay for a reserved instance.

Thanks!

Tim

Hi Tim/Vitale,

Apologies for the delay. The AMIs are now available. Let us know what you think. Thanks.

community.sophos.com/.../sophos-utm-9-409-on-aws-release-notes

RichVorwaller

I just tried HA (warm) standby I get the following precheck error.

RichVorwaller

I just tried HA (warm) standby I get the following precheck error.

Huston I think we have lift off after retring and waiting 5 min recreating IAM roles I think we have a conversion.

No the conversion failed and is rolling back who can call me 718-790-1150 and help me with this.

AWS stack error

My username and access key policy for AWS sophos is below it has SNS in it why is it failing

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateStack"
            ],
            "Resource": "*",
            "Condition": {
                "ForAllValues:StringLike": {
                    "cloudformation:TemplateUrl": [
                        "https://s3.amazonaws.com/sophos-nsg-cf/*"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:Create*",
                "ec2:Describe*",
                "ec2:AuthorizeSecurityGroup*",
                "ec2:AllocateAddress",
                "ec2:AssociateRouteTable",
                "ec2:ReplaceNetworkAclAssociation",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:TerminateInstances",
                "cloudformation:Describe*",
                "cloudwatch:PutMetricAlarm",
                "autoscaling:Create*",
                "autoscaling:Describe*",
                "autoscaling:PutScalingPolicy",
                "autoscaling:PutNotificationConfiguration",
                "autoscaling:UpdateAutoScalingGroup",
                "elasticloadbalancing:CreateLoadBalancer",
                "elasticloadbalancing:ModifyLoadBalancerAttributes",
                "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
                "elasticloadbalancing:ConfigureHealthCheck",
                "iam:CreateRole",
                "iam:PutRolePolicy",
                "iam:CreateInstanceProfile",
                "iam:AddRoleToInstanceProfile",
                "iam:PassRole",
                "sns:CreateTopic",
                "sns:ListTopics",
                "sns:Subscribe",
                "s3:CreateBucket",
                "s3:Get*",
                "s3:Delete*",
                "s3:List*",
                "s3:PutObject"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:Delete*",
                "ec2:DisassociateRouteTable",
                "ec2:releaseAddress",
                "autoscaling:Delete*",
                "elasticloadbalancing:DeleteLoadBalancer",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:Delete*"
            ],
            "Resource": "*"
        }
    ]
}

I added some more SNS actions.

                "sns:CreateTopic",
                "sns:Publish",
                "sns:ListTopics",
                "sns:Subscribe",
                "sns:CreateTopic",
                "sns:GetTopicAttributes",
                "sns:ListSubscriptionsByTopic",

The auto scaling is not working I'm stuck at this point

Issue was caused by not having an AWS market place license for the secondary HA unit, went to the market place and added a secondary subscription.

After deploying in HA what is the default user name and password because the conversion dosnt carry over the username and password I cant log into the Firewall after the conversion.

Hi Vitale,

Thanks for the feedback and update. Someone from our Solutions Architect team will reach out to touch base with you. Ping us at aws.marketplace@sophos.com if you need anything else.