XG firewall migration to 18 : probably a BUG

Hi Giorgio Premoli1 

As per our discussion on twitter, request you to share the backup file from v17 and also open a service request and share the service request number you will receive from the support.

Case number #9822103

Many thanks

Just to be clear: This configuration of yours, which is not getting migrated, how old is the backup? 

I am not talking about the current Software version or something like that. How old is the Backup? Or to rephrase this question, how long is this customer using XG? 

There are many installation already on V18 and we found rare cases, which could not migrate. 

Hi dear LuCar,

the backup is extremly recent, of course; let's say the same day I opened the question; but also the configuration is not "hystorical", it has been created on the second half of 2019; anyway, this is an active configuration, changed each time as new need arrives or is required. I understand what you mean, but each my customers' configuration is not "old", but mostly each of them is "alive", not only it is running today, but also because in each configuration have dinamically added new items, or deleted what is no longer needed; in other words, also if the first configuration has been created 1 year ago -or more, for some customers-, this configuration is alive and updated. If I have to create it from the beginning, I'll create exactly all as it is now.

I can understand what you mean for "old" and is difficult for anyone to say "I'm sure, there isn't any 'not still used' parameter" (like Hosts or IPes, rules, etc.), "the configuration is clean and it doesn't contain any unused object brought by previous release versions", but is also true that all them are running on version 17.5 (also if they started in version 16 or older), but no longer on v.18

I well understand that the (retro) compatibility is a big issue that requires an enormous debugging-work, but is totally unthinkable to rewrite from the beginning all the running configurations because otherwise the ver.18 doesn't support them (or what was accepted and running on 17.5.10); that means to not migrate anything

My best Regards

Giorgio

Hi all

Unfortunately I cannot upgrade either. Is this an known problem?

Restore from my running Image SFOS 17.5.12 MR-12 to Image Version 18 failed. Also the Import function dosen't work (System/ Backup & Firmware/ Import)
- my active OS: SFOS 17.5.12 MR-12
- the whole configuration is running with this Image SFOS 17.5.12 MR-12.

Why Upgrade to Version 18?
Reason one: Im not sure, is my running configuration safe or not, why? The Sophos XG Firewall displays Alerts! 
- Alert: Hotfix applied for SQL Injection and partially cleaned. Additional steps may be required to secure your network. Please read KBA-135412 for possible next steps
- Alert: HF052220.1 applied. Local and guest user password reset required for accounts that have not reset their password since 2200 UTC on April 25, 2020. Local users will be disabled from    signing in to the user portal from the WAN zone until password is reset. Please read KBA-135493 for recommended next steps.
- All admin and local user accounts must reset their passwords per KBA135412. Click here to access the User page.

Reason two: I find various settings strange
- Active Sync: I'm not able to configure Microsoft Active Sync. I tried many configurations. In the end, I even deactivated the option "common threat filter" (protection policy for autodiscover) and in the Firewall rulte, i added all possible Points for exceptions - tested severals apps, but Microsoft Active-Sync wont work - never! It is not possible, very strange.
- many protectin policies are grayed out (Protect/ Web Server/ Protection policies) and i'm not able to delete them and no, it doesn't matter whether you're in use or not.
- The Firmware Check said: no records found (no Version 18.x for downloading)

Idea
i thought: Patch your System with the latest Firmware SFOS 18.0.0-379, after them, restore the config from SFOS 17.5.12 MR-12 (created bevor the upgrade).
- But the Firmware Check said: no records found, so the newest Version of Sophos XG OS is SFOS 17.5.12 MR-12? No Version 18.x for downloading, why?
- ok, so i can get another whay to find and download Version 18.x. Login to my Online Sopohos Portal https://id.sophos.com /Network Protection/ View Devices/ under the registered version on download and here, i was able to view all available versions for my Sophos XG. All right, fine.

Problem
- i had uploaded the version 18 to my Sophox XG
- i had activated this Image, Version 18. So, my Firewall applies this image, restartet and i was not able to connect my sophos XG. Ok, i thought: No Problem, she is now configured with default settings. The Connection to IP 172.16.16.16 /24 was possible. All right, i thougt. But the default Password and username, if you reset or start a default image with Usrename = admin and password = admin dosen't work. The old Admin Password from my Configuration was still valid. 

Nice new Sophos XG login page, very nice. Login with the old admin Credentials works, fine.
- Only two NICs are available,
- only the default Firewall Rules are available and so one.

I was particularly interested for the config now under the Point: Web server/ Protection policies.
- 6 of 10 guidelines were inactive (with Version OS: SFOS 17.5.12 MR-12).
- now, with the Version 18 only the inactive guidelines appear. As mentioned: I cannot delete them, just edit them. i thought i had loaded the latest version and ALL Settings are now default and now? I have a mix configuration. I little bit default Settings with Settings, which are grayed out and not possible to delete them. What is going on?

But what bothers me the most: Why can't I import the backup? i get an error and also import the File which have ALL SETTING dosen't work (error). What is going on?
So, i had to activate my old version again - maybe, a hacked Version?! ...

Hello

Much of the same here.  Importing from backup have allways been an act of faith with XG.  And particularly since they decided to lock it with a password.  It fails 80% of the time.  As far as I am concerned, it works only when it is very recent.

Paul Jr

Quite simple: As V18.0 MR1 is not released yet, there is no migration path. 

https://community.sophos.com/products/xg-firewall/b/blog/posts/xg-firewall-v18-mr1-is-now-available

https://community.sophos.com/kb/en-us/135378

V17.5 MR11-12 need V18.0 MR1 to upgrade, as most of the stuff in V18.0 are renamed and can not be migrated.

Hence the Migration via API/XML does not work for everything. 

About this WAF Issue, i would recomemnd to open a new thread with Screenshots, as i cannot follow up your issue. 

thank you for answer. encrypting backups with a password makes sense or not? What do you mean? Sophos has a problem with that? (for accept the Backup Image an so on)

Hey Toni

That means I have to wait until a newer 18 version appears?
Toni, you again? but you can be seen here very often, I'm glad :-)

Yes, i think, i must open a new area for my Microsoft Active-Sync Problem.
But you didn't say anything that my firewall might have been hacked? So, this is also a reason to upgrade my Sophos XG or: Reinstall with the same Image and then make a restore the backup.

Makes sense when it is implemented properly.  With XG, thousands of things can go wrong, and sure enough, when it fails the error message is clueless.

And you cannot opt out encrypting.

Paul Jr

You should use V17.5 MR12 for an new installation. Restore the Backup should work smoothly. 

Only the import into V18 does not work (right now). 

So please reimage your installation with V17.5 MR12. 

https://community.sophos.com/products/xg-firewall/b/blog/posts/xg-firewall-17-5-mr12-released

Install V17.5. Complete the wizard until you get into the webadmin.

Wait some minutes to get the latest Hotfixes installed.

Import the backup with the Encryption password. 

All right. The post for Active Sync is coming, but not today ;)
First, i will reinstall my Sophos with the same Version of Image. Maybe in a few days ...

All right. The post for Active Sync is coming, but not today ;)
First, i will reinstall my Sophos with the same Version of Image. Maybe in a few days ...