Hello
In this document - community.sophos.com/.../122742
it says - Other than WAF, no other features are supported on Sophos UTM Auto Scaling.
May i know which features are not supported ?
Thanks,
Steve
Hi Steve,
I forwarded this question to our AWS team, and this is the answer they provided:
The auto scaling deployment model for AWS supports all existing UTM features. There are however a few functionalities that are harder / nonsensical to implement on an autoscaling cluster.
For example, implementing client VPNs on an autoscaling cluster will work, but you will introduce significant routing issues due to having multiple individual routers (your workers) represent the same subnet (the SSL VPN clients) with none of the nodes being aware of the other’s IP address leases (so duplicate IPs are rampant) or the AWS router being able to accurately determine which worker holds the exact client it wants to send the return traffic to.
This is why we recommend not using this functionality on autoscaled clusters, but we have no limitation (licensing or otherwise) in place should you still desire to use it.
Similarly, your workers are all capable of running the Wireless Protection features and working as wireless controllers. Doing so makes no sense though as there is no significant performance increase to be gained and your wireless controller architecture is now needlessly complex due to the possibility of a controller suddenly ceasing to exist.
And your wireless networks are not connected to each other so being on the same SSID doesn’t mean you are actually part of the same network anymore.
So in summary, you are not limited by us in what you can use, but the platform and deployment model might limit you in which features you would want to use.
Hope that helps,
Karlos
Hi Steve,
I forwarded this question to our AWS team, and this is the answer they provided:
The auto scaling deployment model for AWS supports all existing UTM features. There are however a few functionalities that are harder / nonsensical to implement on an autoscaling cluster.
For example, implementing client VPNs on an autoscaling cluster will work, but you will introduce significant routing issues due to having multiple individual routers (your workers) represent the same subnet (the SSL VPN clients) with none of the nodes being aware of the other’s IP address leases (so duplicate IPs are rampant) or the AWS router being able to accurately determine which worker holds the exact client it wants to send the return traffic to.
This is why we recommend not using this functionality on autoscaled clusters, but we have no limitation (licensing or otherwise) in place should you still desire to use it.
Similarly, your workers are all capable of running the Wireless Protection features and working as wireless controllers. Doing so makes no sense though as there is no significant performance increase to be gained and your wireless controller architecture is now needlessly complex due to the possibility of a controller suddenly ceasing to exist.
And your wireless networks are not connected to each other so being on the same SSID doesn’t mean you are actually part of the same network anymore.
So in summary, you are not limited by us in what you can use, but the platform and deployment model might limit you in which features you would want to use.
Hope that helps,
Karlos
Hi Steve,
We do not have an official list, but we’d generally recommend using the autoscaling deployment for the following features:
Cheers,
Karlos
Your welcome!
Also moved your post from General to UTM on AWS thread
Cheers,
Karlos
