Dear Community, I already had the possibility to present v18 to some customers in a live demo and showed them the changes made into v18. The features are very welcome and "approved" by the customers but the problem is how these features are implemented. DNAT: customers really liked the way Sophos was allowing the creation of DNAT Wizard. Sophos wanted to follow the competition instead of creating their own product. Also, the DNAT wizard windows is very raw. Current DNAT is very copy and paste from other vendors and it is a step backward compared to BAR implementation Current DNAT wizard: the wizard creates loopback and reflexive rules automatically, so all the time you need to delete them. The Wizard does not enable logging by default, does not allows you to select IPS profile and it is enabled by default If you delete the DNAT firewall rules, it does not delete the associated DNAT rules. Really? This is another example of bad design/implementation! WAF: WAF is under action. Dear Sophos this is very bad design! I am sure a lot of customers will complain this as it is not straightforward. The success of ASTARO was simplicity while XG is complicated SD-WAN: for SD-WAN, users need to move between 3 tabs and 2 menu (firewall, nat and SD-WAN under Routing). This is another example of bad design and copy and paste example. In my opinion, I would have renamed Firewall tab to Policy tab and Leave the BAR Create a new wizard with SD-WAN policy where linked NAT creates the associated NAT. Icon inside firewall rules: it was straightforward to recognize a BAR rule vs a standard firewall rules. We have filters but sometimes a simple scroll down (specially when the rules are fewer than 20, you can on the fly recognise the BAR instead of reading all rules now or using filters DPI vs PROXY: the 2 checkboxes create a lot of confusion. To be honest I do not have an idea how to improve this point. Community users what do you think?

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

v17 VS v18: things that are just a step backward

Dear Community,

I already had the possibility to present v18 to some customers in a live demo and showed them the changes made into v18. The features are very welcome and "approved" by the customers but the problem is how these features are implemented.

DNAT: customers really liked the way Sophos was allowing the creation of DNAT Wizard. Sophos wanted to follow the competition instead of creating their own product. Also, the DNAT wizard windows is very raw. Current DNAT is very copy and paste from other vendors and it is a step backward compared to BAR implementation
Current DNAT wizard: the wizard creates loopback and reflexive rules automatically, so all the time you need to delete them. The Wizard does not enable logging by default, does not allows you to select IPS profile and it is enabled by default
If you delete the DNAT firewall rules, it does not delete the associated DNAT rules. Really? This is another example of bad design/implementation!
WAF: WAF is under action. Dear Sophos this is very bad design! I am sure a lot of customers will complain this as it is not straightforward. The success of ASTARO was simplicity while XG is complicated
SD-WAN: for SD-WAN, users need to move between 3 tabs and 2 menu (firewall, nat and SD-WAN under Routing). This is another example of bad design and copy and paste example. In my opinion, I would have renamed Firewall tab to Policy tab and
- Leave the BAR
- Create a new wizard with SD-WAN policy where linked NAT creates the associated NAT.
Icon inside firewall rules: it was straightforward to recognize a BAR rule vs a standard firewall rules. We have filters but sometimes a simple scroll down (specially when the rules are fewer than 20, you can on the fly recognise the BAR instead of reading all rules now or using filters
DPI vs PROXY: the 2 checkboxes create a lot of confusion. To be honest I do not have an idea how to improve this point.

Community users what do you think?

This thread was automatically locked due to age.

Parents

0 Billybob over 5 years ago

I have given up on feedback. I use the product as is and then decide if I am ok with its capabilities. The problem is when you don't like the feature as implemented, they will say other vendors do it this way so we are making it easier for everyone. The other answer that I like best is if XG can't do something, they will say UTM can't do it either or UTM also does it the same way (yes UTM development ended years ago).

The whole NAT section is a mess, live viewer while better than nothing is bad, kilobyte and kilobit usage is bad, setting up exceptions for streaming media etc. all the time in proxy and DPI is bad, logging has always been bad but you have another thread. Firewall section was always difficult in XG specially if you configured IPS, application rules and QoS etc yourself. Now with added NAT complexity, its even more confusing.

All is not bad though, XG v18 is extremely fast, alot faster than v17.5 that I used about a year ago. If you throw enough hardware at it, its not a bad firewall. Also, all the complexity will keep some of the network admins employed a little longer as you really need to understand the firewall if you want to administer it to its full potential.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Billybob over 5 years ago

I have given up on feedback. I use the product as is and then decide if I am ok with its capabilities. The problem is when you don't like the feature as implemented, they will say other vendors do it this way so we are making it easier for everyone. The other answer that I like best is if XG can't do something, they will say UTM can't do it either or UTM also does it the same way (yes UTM development ended years ago).

The whole NAT section is a mess, live viewer while better than nothing is bad, kilobyte and kilobit usage is bad, setting up exceptions for streaming media etc. all the time in proxy and DPI is bad, logging has always been bad but you have another thread. Firewall section was always difficult in XG specially if you configured IPS, application rules and QoS etc yourself. Now with added NAT complexity, its even more confusing.

All is not bad though, XG v18 is extremely fast, alot faster than v17.5 that I used about a year ago. If you throw enough hardware at it, its not a bad firewall. Also, all the complexity will keep some of the network admins employed a little longer as you really need to understand the firewall if you want to administer it to its full potential.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data