This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Forum for HA and Autoscaling UTM deployments @ AWS?

I feel like it would be beneficial to have a separate sub-forum specifically for discussing UTM deployments in the AWS environment.  Particularly for those of us working on getting the HA and/or Autoscaling implementations to work properly.  While the webpage here: www.sophos.com/aws seems to suggest that AWS integration is a widely used and perfectly tuned feature of the UTM, those of us who have been tinkering around with it know that Sophos still has a ways to go in ramping up their own internal expertise and supporting documentation for this use-case.    All the more reason for easy channels for collaboration among the community.

At the very least, I'd love to hear from anyone else out there who's currently working with the HA implementation.  I'm alternately impressed and frustrated with it thus far :)  but I think it could be a truly amazing product with a bit more fine tuning-- and I think strong community involvement is going to be the driving force to make that happen.  



This thread was automatically locked due to age.
Parents
  • hi, any update on this ? im interested in this feature on AWS.

     

    thanks

    P.

  • I've been trying this for few weeks as well.  

     

    Apparently, the firmware upgrade within UTM does not do anything for HA/Autoscaling.  It's basically UTM software patch(eg. Windows security patch vs Windows Service Pack).  What has to happen is that you have to download entirely new AMI version(9.4x) from AWS marketplace and reconfigure the new instance from scratch.  or use backup to reload your configurations.  Which it kind of sucks because, it requires more work than just simple upgrade.  

     

    Sophos is really behind on their contents on this matter.  Their template is pointing to the wrong AMI version(9.3x) so you have to manually change that first and their instructions is wrong as well.  

  • Any update on the HA release I will have to use cisco or fortnet for my AWS solution if we can not make the HA conversion work. Please let us know timeline ?

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  • Hi Vitale,

    We're looking to fix this in 9.409, which is scheduled for the week of December 26. We'll keep you posted when we publish.

    Thanks.

  • Rich thank you for the update will this address the HA GUI deployment

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  • Hi Vitale,

    You're welcome. We just pushed 9.409 to the AWS Marketplace today. It will probably take AWS a couple of days to scan the AMIs and publish them. We'll let you know when we hear a date. Once 9.409 is published, the conversion utility for HA should work. We'll follow up in January with a 9.10 release that will support the conversion utility for Auto Scaling.

    Let me know if you have any questions. Thanks.

  • Thank you for the update I went ahead and upgraded the existing firewall, to version  9409 as you can see in my screen shot below but I was unable to complete the HA setup still. Is there a reson why I cant deploy HA after the upgrade? Do i really need to launch a brand new instance from AWS market place first? If so which instance do I need Launch.

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  • Thanks Vitale,

    There are two ways customers can update Sophos UTM on AWS. One way is via up2date, which I believe is the method you used. This update path is only available for our Stand Alone (Single AMI) release and uses the normal update process for all UTMs.

    Because our Auto Scaling and HA releases uses multiple AMIs, these releases don't update via up2date. Instead we've built a process called Cloud Update which uses CloudFormation stack updates to update the different AMIs. The conversion utility also uses CloudFormation stack updates as the process converts a Single AMI to multiple AMIs (depending on the option you choose). This means that the conversion utility won't work until (1) AWS publishes the latest AMI in the AWS Marketplace, and (2) we've updated our CloudFormation templates with the new AMI IDs (which AWS gives us).

    docs.aws.amazon.com/.../using-cfn-updating-stacks.html

    Again, we just pushed 9.409 to the AWS Marketplace yesterday. It usually takes AWS a couple of days to scan and publish them, with the holidays it may take a bit more. As soon as AWS comes back with the new AMI IDs, we'll update our templates and then the conversion utility should work. We'll let you know when we hear back from AWS.

    Hope that makes sense. If not, ping us via aws.maketplace@sophos.com and we can arrange a call.

    Thanks.

  • Hi.  I have been waiting for these AMIs to publish but it seems like it is taking longer than expected.   Do you have any kind of update on when they will be available?  I'm waiting to deploy a new single instance of 9.409 using HVM so that I can prepay for a reserved instance.

     

    Thanks!

     

    Tim

  • Hi Tim/Vitale,

     

    Apologies for the delay. The AMIs are now available. Let us know what you think. Thanks.

     

    community.sophos.com/.../sophos-utm-9-409-on-aws-release-notes

  • RichVorwaller

     

    I just tried HA (warm) standby I get the following precheck error.

     

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  • Huston I think we have lift off after retring and waiting 5 min recreating IAM roles I think we have a conversion.

     

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

Reply Children
  • No the conversion failed and is rolling back who can call me 718-790-1150 and help me with this.

     

     

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  • AWS stack error

     

    Events
    2017-01-07 Status Type Logical ID Status reason
      00:11:32 UTC-0500 DELETE_IN_PROGRESS AWS::EC2::RouteTable RouteTable  
      00:11:30 UTC-0500 DELETE_COMPLETE AWS::EC2::Subnet Subnet2  
      00:11:29 UTC-0500 DELETE_COMPLETE AWS::EC2::Subnet Subnet1  
      00:11:29 UTC-0500 DELETE_COMPLETE AWS::EC2::Route Route  
      00:11:17 UTC-0500 DELETE_COMPLETE AWS::IAM::Role UTMRole  
      00:11:16 UTC-0500 DELETE_IN_PROGRESS AWS::IAM::Role UTMRole  
      00:11:15 UTC-0500 DELETE_COMPLETE AWS::EC2::SecurityGroup UntrustedGroup  
      00:11:15 UTC-0500 DELETE_COMPLETE AWS::EC2::SecurityGroup UTMSecurityGroup  
      00:11:15 UTC-0500 DELETE_COMPLETE AWS::EC2::SecurityGroup TrustedNetworkGroup  
      00:11:14 UTC-0500 DELETE_COMPLETE AWS::IAM::InstanceProfile UTMInstanceProfile  
      00:11:14 UTC-0500 DELETE_IN_PROGRESS AWS::EC2::Subnet Subnet1  
      00:11:13 UTC-0500 DELETE_FAILED AWS::SNS::Topic UnhealthyTopic User: arn:aws:iam::525021013121:user/Sophos is not authorized to perform: SNS:DeleteTopic on resource: arn:aws:sns:us-east-1:525021013121:sophosHaWarm-UnhealthyTopic-QPUZOQHRU0JT
      00:11:13 UTC-0500 DELETE_IN_PROGRESS AWS::EC2::Route Route  
      00:11:13 UTC-0500 DELETE_IN_PROGRESS AWS::EC2::SecurityGroup UTMSecurityGroup  
      00:11:13 UTC-0500 DELETE_IN_PROGRESS AWS::EC2::Subnet Subnet2  
      00:11:13 UTC-0500 DELETE_IN_PROGRESS AWS::IAM::InstanceProfile UTMInstanceProfile  
      00:11:13 UTC-0500 DELETE_IN_PROGRESS AWS::EC2::SecurityGroup TrustedNetworkGroup  
      00:11:13 UTC-0500 DELETE_IN_PROGRESS AWS::SNS::Topic UnhealthyTopic  
      00:11:13 UTC-0500 DELETE_IN_PROGRESS AWS::EC2::SecurityGroup UntrustedGroup  
      00:10:52 UTC-0500 ROLLBACK_IN_PROGRESS AWS::CloudFormation::Stack sophosHaWarm The following resource(s) failed to create: [Subnet1, UnhealthyTopic, UTMSecurityGroup, UntrustedGroup, Route, UTMInstanceProfile, TrustedNetworkGroup, Subnet2]. . Rollback requested by user.
      00:10:50 UTC-0500 CREATE_FAILED AWS::EC2::SecurityGroup UntrustedGroup Resource creation cancelled
      00:10:49 UTC-0500 CREATE_FAILED AWS::EC2::SecurityGroup TrustedNetworkGroup Resource creation cancelled
      00:10:49 UTC-0500 CREATE_FAILED AWS::EC2::SecurityGroup UTMSecurityGroup Resource creation cancelled
      00:10:47 UTC-0500 CREATE_FAILED AWS::EC2::Subnet Subnet2 Resource creation cancelled
      00:10:47 UTC-0500 CREATE_FAILED AWS::IAM::InstanceProfile UTMInstanceProfile Resource creation cancelled
      00:10:47 UTC-0500 CREATE_FAILED AWS::EC2::Subnet Subnet1 Resource creation cancelled
      00:10:47 UTC-0500 CREATE_FAILED AWS::EC2::Route Route Resource creation cancelled
      00:10:46 UTC-0500 CREATE_IN_PROGRESS AWS::IAM::InstanceProfile UTMInstanceProfile Resource creation Initiated
      00:10:46 UTC-0500 CREATE_FAILED AWS::SNS::Topic UnhealthyTopic User: arn:aws:iam::525021013121:user/Sophos is not authorized to perform: SNS:GetTopicAttributes on resource: arn:aws:sns:us-east-1:525021013121:sophosHaWarm-UnhealthyTopic-QPUZOQHRU0JT
      00:10:46 UTC-0500 CREATE_IN_PROGRESS AWS::IAM::InstanceProfile UTMInstanceProfile  
      00:10:41 UTC-0500 CREATE_COMPLETE AWS::IAM::Role UTMRole  
      00:10:40 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Route Route Resource creation Initiated
      00:10:39 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Route Route  
      00:10:35 UTC-0500 CREATE_COMPLETE AWS::EC2::RouteTable RouteTable  
      00:10:35 UTC-0500 CREATE_IN_PROGRESS AWS::SNS::Topic UnhealthyTopic Resource creation Initiated
      00:10:35 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Subnet Subnet2 Resource creation Initiated
      00:10:34 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Subnet Subnet1 Resource creation Initiated
      00:10:34 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::RouteTable RouteTable Resource creation Initiated
      00:10:34 UTC-0500 CREATE_IN_PROGRESS AWS::SNS::Topic UnhealthyTopic  
      00:10:34 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Subnet Subnet2  
      00:10:34 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SecurityGroup UntrustedGroup  
      00:10:34 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::RouteTable RouteTable  
      00:10:34 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Subnet Subnet1  
      00:10:34 UTC-0500 CREATE_IN_PROGRESS AWS::IAM::Role UTMRole Resource creation Initiated
      00:10:33 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SecurityGroup TrustedNetworkGroup  
      00:10:33 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SecurityGroup UTMSecurityGroup  
      00:10:33 UTC-0500 CREATE_IN_PROGRESS AWS::IAM::Role UTMRole  
      00:10:28 UTC-0500 CREATE_IN_PROGRESS AWS::CloudFormation::Stack sophosHaWarm User Initiated

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  • My username and access key policy for AWS sophos is below it has SNS in it why is it failing

     

     

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "cloudformation:CreateStack"
                ],
                "Resource": "*",
                "Condition": {
                    "ForAllValues:StringLike": {
                        "cloudformation:TemplateUrl": [
                            "https://s3.amazonaws.com/sophos-nsg-cf/*"
                        ]
                    }
                }
            },
            {
                "Effect": "Allow",
                "Action": [
                    "ec2:Create*",
                    "ec2:Describe*",
                    "ec2:AuthorizeSecurityGroup*",
                    "ec2:AllocateAddress",
                    "ec2:AssociateRouteTable",
                    "ec2:ReplaceNetworkAclAssociation",
                    "ec2:RevokeSecurityGroupEgress",
                    "ec2:TerminateInstances",
                    "cloudformation:Describe*",
                    "cloudwatch:PutMetricAlarm",
                    "autoscaling:Create*",
                    "autoscaling:Describe*",
                    "autoscaling:PutScalingPolicy",
                    "autoscaling:PutNotificationConfiguration",
                    "autoscaling:UpdateAutoScalingGroup",
                    "elasticloadbalancing:CreateLoadBalancer",
                    "elasticloadbalancing:ModifyLoadBalancerAttributes",
                    "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
                    "elasticloadbalancing:ConfigureHealthCheck",
                    "iam:CreateRole",
                    "iam:PutRolePolicy",
                    "iam:CreateInstanceProfile",
                    "iam:AddRoleToInstanceProfile",
                    "iam:PassRole",
                    "sns:CreateTopic",
                    "sns:ListTopics",
                    "sns:Subscribe",
                    "s3:CreateBucket",
                    "s3:Get*",
                    "s3:Delete*",
                    "s3:List*",
                    "s3:PutObject"
                ],
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": [
                    "ec2:Delete*",
                    "ec2:DisassociateRouteTable",
                    "ec2:releaseAddress",
                    "autoscaling:Delete*",
                    "elasticloadbalancing:DeleteLoadBalancer",
                    "iam:RemoveRoleFromInstanceProfile",
                    "iam:Delete*"
                ],
                "Resource": "*"
            }
        ]
    }

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  • I added some more SNS actions.

     

                    "sns:CreateTopic",
                    "sns:Publish",
                    "sns:ListTopics",
                    "sns:Subscribe",
                    "sns:CreateTopic",
                    "sns:GetTopicAttributes",
                    "sns:ListSubscriptionsByTopic",

     

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  • The auto scaling is not working I'm stuck at this point

     

     

     

    2017-01-07 Status Type Logical ID Status reason
      00:29:38 UTC-0500 CREATE_IN_PROGRESS AWS::AutoScaling::AutoScalingGroup UTMScalingGroup Resource creation Initiated
      Physical ID:sophosHAwarm-UTMScalingGroup-1JU9ZT57300OS
      00:29:37 UTC-0500 CREATE_IN_PROGRESS AWS::AutoScaling::AutoScalingGroup UTMScalingGroup  
      00:29:32 UTC-0500 CREATE_COMPLETE AWS::AutoScaling::LaunchConfiguration UTMLaunchConfiguration  
      00:29:32 UTC-0500 CREATE_IN_PROGRESS AWS::AutoScaling::LaunchConfiguration UTMLaunchConfiguration Resource creation Initiated
      00:29:31 UTC-0500 CREATE_IN_PROGRESS AWS::AutoScaling::LaunchConfiguration UTMLaunchConfiguration  
      00:29:26 UTC-0500 CREATE_COMPLETE AWS::IAM::InstanceProfile UTMInstanceProfile  
      00:27:52 UTC-0500 CREATE_COMPLETE AWS::EC2::SubnetRouteTableAssociation Subnet1RouteTableAssociation  
      00:27:48 UTC-0500 CREATE_COMPLETE AWS::EC2::SubnetRouteTableAssociation Subnet2RouteTableAssociation  
      00:27:37 UTC-0500 CREATE_COMPLETE AWS::EC2::Route Route  
      00:27:36 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SubnetRouteTableAssociation Subnet1RouteTableAssociation Resource creation Initiated
      00:27:34 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SubnetRouteTableAssociation Subnet1RouteTableAssociation  
      00:27:32 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SubnetRouteTableAssociation Subnet2RouteTableAssociation Resource creation Initiated
      00:27:31 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SubnetRouteTableAssociation Subnet2RouteTableAssociation  
      00:27:30 UTC-0500 CREATE_COMPLETE AWS::EC2::SecurityGroup UntrustedGroup  
      00:27:30 UTC-0500 CREATE_COMPLETE AWS::EC2::Subnet Subnet1  
      00:27:28 UTC-0500 CREATE_COMPLETE AWS::EC2::SecurityGroup TrustedNetworkGroup  
      00:27:28 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SecurityGroup UntrustedGroup Resource creation Initiated
      00:27:27 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SecurityGroup TrustedNetworkGroup Resource creation Initiated
      00:27:27 UTC-0500 CREATE_COMPLETE AWS::EC2::SecurityGroup UTMSecurityGroup  
      00:27:27 UTC-0500 CREATE_COMPLETE AWS::EC2::Subnet Subnet2  
      00:27:26 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SecurityGroup UTMSecurityGroup Resource creation Initiated
      00:27:24 UTC-0500 CREATE_IN_PROGRESS AWS::IAM::InstanceProfile UTMInstanceProfile Resource creation Initiated
      00:27:24 UTC-0500 CREATE_IN_PROGRESS AWS::IAM::InstanceProfile UTMInstanceProfile  
      00:27:23 UTC-0500 CREATE_COMPLETE AWS::SNS::Topic UnhealthyTopic  
      00:27:22 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Route Route Resource creation Initiated
      00:27:21 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Route Route  
      00:27:19 UTC-0500 CREATE_COMPLETE AWS::IAM::Role UTMRole  
      00:27:13 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Subnet Subnet1 Resource creation Initiated
      00:27:13 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Subnet Subnet1  
      00:27:12 UTC-0500 CREATE_COMPLETE AWS::EC2::RouteTable RouteTable  
      00:27:11 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SecurityGroup UntrustedGroup  
      00:27:11 UTC-0500 CREATE_IN_PROGRESS AWS::IAM::Role UTMRole Resource creation Initiated
      00:27:11 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::RouteTable RouteTable Resource creation Initiated
      00:27:11 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Subnet Subnet2 Resource creation Initiated
      00:27:11 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SecurityGroup UTMSecurityGroup  
      00:27:10 UTC-0500 CREATE_IN_PROGRESS AWS::SNS::Topic UnhealthyTopic Resource creation Initiated
      00:27:10 UTC-0500 CREATE_IN_PROGRESS AWS::IAM::Role UTMRole  
      00:27:10 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::RouteTable RouteTable  
      00:27:10 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::SecurityGroup TrustedNetworkGroup  
      00:27:10 UTC-0500 CREATE_IN_PROGRESS AWS::EC2::Subnet Subnet2  
      00:27:10 UTC-0500 CREATE_IN_PROGRESS AWS::SNS::Topic UnhealthyTopic  
      00:27:04 UTC-0500 CREATE_IN_PROGRESS AWS::CloudFormation::Stack sophosHAwarm User Initiated

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  •  

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  • Issue was caused by not having an AWS market place license for the secondary HA unit, went to the market place and added a secondary subscription.

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  • After deploying in HA what is the default user name and password because the conversion dosnt carry over the username and password I cant log into the Firewall after the conversion.

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com

  • Hi Vitale,

     

    Thanks for the feedback and update. Someone from our Solutions Architect team will reach out to touch base with you. Ping us at aws.marketplace@sophos.com if you need anything else.

  • Guys @ Sophos I dont mind being the beta tester But I have a live AWS production environment and need stable HA firewall implementation ASAP I have benn patient

     

    1) Waited for multiple sophos  releases

    2)Deployed and talked to product engineering about set backs of HA deployment

    3) Got on a phone call with video recording to Show current Sophos UTM 9 HA pair cloudformation issues and adjustments that Sophos needs to take,

     

    4) Unable to pick my own production DMZ or Public subnets when running a HA conversion ? This needs to be fixed asap Sophos by default takes existing Subnet and as an example changes the Third octet for a New public subnet  in my case sophos created 10.74.1.0 public subnet One and Public subnet two 10.74.2.0  in my prod environment My subnets are 10.74.3.0 and 10.74.4.0 Sophos needs to adjust and let the customer choose where the HA conversion AMI are deployed.

     

    With the Above point NO one can use the HA cut over in a production environment without making live route table change or adjustments.

     

     

    5) When deploying the HA conversion Unable to login to the New HA pair firewalls this is an issue No default user name or password work including the one from the Source conversion firewall where the HA conversion was started.

     

    6) The assumption that two new HA AWS AMIs are created during the conversion is ridiculous, If I already have a single production Sophos firewall running , All I want is to Hit the HA conversion wizard and have one warm firewall spin up and attach itself to my current production firewall.  This is clearly not the behavior in the cloud formation template.

     

     

    The behavior when doing a new Warm HA conversion creates two new Sophos AMI's firewalls in their own public subnet inside my VPC. This dosnt make life easier it creates more complexity with end customer having to make route table and ACL changes on their production environment.

     

    What was expected with this release.

     

    1) To run HA conversion wizard "Warm"

    2)two have a single AMI spin up

    3)That new AMI is synces with S#, SNS,

    4)The current production source firewall that is working and where the conversion for HA has been initiated from stays in place and works to sync with S3, SNS, auto-scaling etc.... to create HA fail-over.

     

    This has not been done

     

    Instead sophos took the HA conversion utility within the production firewall AMI that a comapny might have and created a path for a brand new (Subnet, HA Firewall Pair AMI, and isolated the deployment within your production VPC) 

     

    How is this useful at all?

     

    The consideration is the customer and company, again I wrote above what is expected and required for this to be successful, Again I'm willing to work with Sophos engineering team to test live in my prod environment.

     

    Byron J. Watson  you are the Security Solution Architect , I did speak with you and let you video record all the issues above.  What is the update ?

     

     

     

     

     

     

     

    Thank You

     

    Vitale Mazo

     

     

    Vitale Mazo | Senior Systems Engineer
    Novus Partners Inc | 200 Park Avenue, 27th Floor  | New York, NY 10166
    212.586.3030 Ext. 1093 | Cell: 718-790-1150 | Vmazo@novus.com