When (if ever) will UTM support IKEv2?

Here's a roadmap i got from a webinar earlier this year. There should be some kind of VPN changes for version 9.6 (which i have heard got delayed to next year)... I don't know if it means IKEv2 is implemented, but i sure hope so.. And Openvpn 2.4.X would be a nice welcome as well

Thanks for the image of the roadmap.

IKEv2 is mentioned specifically for SFOS V17, in addition to VPN improvements later on. But yeah, let's hope that IKEv2 is included in those VPN improvements.

I really don't want to, but a delay until next year with no certainties of IKEv2 being included is already making me consider other vendors..

IKEv2 is now supported on the Sophos XG firewall (not the UTM yet). Have you considered transitioning to the XG firewall?

IKEv2 is now supported on the Sophos XG firewall (not the UTM yet). Have you considered transitioning to the XG firewall?

what good is having IKEv2 on XG if nobody/not many want to switch over from UTM?

If you are asking if the switch to XG was considered i'd reply that the switch to another vendor is beeing considered.

Full price subscription on UTM means full expectations, unmet expectations means that we are paying too much (right now).

David, it seems that to run XG, it requires YOUR level of knowledge.  Which sorts out the majority of IT population.  Learning curve is very long - months, if not years - and in the end so much is missing. 

Logs are inaccurate and mostly useless.  It is absolutely required to use CLI for that.

No NTP Time server.

No Real DHCP.  If at least we could push WEB NTP servers addresses and other info to desktops.  XG DHCP is ultra basic and pushes only IP addresses to desktops.

IPv6 implementation is too time consuming.  We have to duplicate everything.  IPv4 and IPv6 on XG is exactly like maintaining TWO firewalls.  Two sets of firewall rules, two sets of everything.  Unworkable.

TLS 1.3 is not on any roadmap.  TLS 1.2 has existed for more than a decade, but implemented only recently on selected Sophos products, and its implementation requires voodoo skills.

At the pace development goes, XG will catch up with competitors in around two years.

There is no rush to get into XGs troubles.  Particularly if one owns a stable UTM ...  Why IKEv2 was not implemented on UTM 10 years ago is unanswerable . 

By the way I really do appreciate your Youtube videos ... Very interesting.

Paul JR

I was told during my architect training, that they are rewriting the core for XG v.18.... So hopefully that fixes some of the annoyances we're facing at the moment... I have started to look around after another vendor.. our UTM license expires next summer.

Hello

I wish I had a better understanding what "the core" really is ... I understand that XG is a collection of open source software, like Strongswan, and that XG is rather a softwares interface to those modules, a reporting service to those modules and a GUI to admin and users ...

To me, "the core" is mostly open source software to which Sophos contributes.  Just theorizing.

Paul Jr

I think you have it right, Paul.

My impression is that the underlying software is mostly the same in both UTM and XG.  I suspect that the Web Filtering engine in the XG is not the one that Astaro created (in V7, I think it was).  XG has a newer version of StrongSWAN and we can only hope that UTM 9.6 brings Charon as a replacement for pluto - probably bringing along IKEv2.

WebAdmin in both the UTM and XG are just GUIs that manipulate databases of objects and settings related to the underlying programs.  In the UTM, the configuration daemon (confd) writes the actual code that does things.  I don't know whether the XG uses confd.

Cheers - Bob