This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG 17.1.0 GA firmware upgrade breaks MTA

NH1 over 5 years ago

I have just tried the upgrade to 17.1.0 GA firmware version, but it breaks MTA.

On the main screen comes up with MTA service DEAD.

Tried reverting to Legacy mode and then back to MTA mode, but that didn't work.

In fact in legacy mode it then reported service SMPTD 'stopped' and one other service I cant recall at the moment.

I see there was a related bug fix in the beta 2 version so thought it would be OK.

But caution if you rely on MTA.

I have reverted to MR8 for now.

This thread was automatically locked due to age.

0 Huy Vu over 5 years ago in reply to CCMF_FW

I think we shouldn't upgrade to 17.1.0 GA until Sophos resolve this issue

- XG v17 Technician Certificate -
Cancel
Vote Up 0 Vote Down

Cancel
0 NH1 over 5 years ago in reply to Huy Vu

For those of you reliant on MTA, I have now upgraded to 17.1 GA successfully.

It was fixed as suggested above, by going into certificates and regenerating the CA for the Appliance SSL certificate, and then rebooting.

And of course if it doesn't the 'revert' option worked very well for me to go back to MR8 while I was waiting for a solution.

So I would suggest you could go ahead and try the upgrade, but allow yourself some "offline" time to do the extra steps.

Hopefully Sophos can automate this as part of future upgrades.
Cancel
Vote Up 0 Vote Down

Cancel
+2 FloSupport over 5 years ago

Hi NH1

To update this thread for our community:

Apologies for the inconvenience caused by this. A KB article has been released to outline what to do to resolve this issue.

Sophos XG Firewall v17.1: How to workaround the issue when MTA service is in DEAD state after firmware upgrade

Regards,

Florentino
Director, Global Community & Digital Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question, please use the 'Verify Answer' button.

The Award-winning Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael Štěpař over 5 years ago in reply to FloSupport

It worked. Thank you
Cancel
Vote Up 0 Vote Down

Cancel
0 Brett Sebring over 5 years ago in reply to FloSupport

We just updated our firmware this past weekend to XG230 (SFOS 17.0.8 MR-8) and discovered this issue. In our case both SMTPD and MTA are "dead". We are not currently using either of those services (G Suite shop) but still don't like the dead services filling up the logs.

I just attempted the fix suggested here but MTA won't restart (503 service failed) despite regenerating SecurityAppliance_SSL_CA.

Please advise.
Cancel
Vote Up 0 Vote Down

Cancel
0 FloSupport over 5 years ago in reply to Brett Sebring

Hey Brett,

My apologies for the inconvenience caused by this. Would it be possible to raise a support case for this for further investigation? Please PM me with your support case number for followup.

Thanks,

Florentino
Director, Global Community & Digital Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question, please use the 'Verify Answer' button.

The Award-winning Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Michael Štěpař over 5 years ago in reply to Brett Sebring

In my case it was just to select different certificate apply and then get back to one I wanted to use, apply and reboot the machine. Since then most of things works like a charm
Cancel
Vote Up 0 Vote Down

Cancel