This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG firewall migration to 18 : probably a BUG

Here, the results of my trials:

I have at home an XG HOME firewall running the version 17.5.10-MR 10; I created and downloaded a backup file

When I tried to upgrade to the firmware version 18, the firewall restarted with the default configuration (Ver.18.0.0.GA running, but just the administrator password set, all other settings have been deleted -no users, no interfaces, no zones, no rules, etc.)

I have also a new XG115 to be prepared/configured for a customer of mine; I registered it, configured it for basic functions and I updated it to the latest firmware version shown (17.5.10-MR10); I also downloaded, from the Sophos site, the related new firmware version 17.5.11-MR11 and 18.0.0 GA Build 354-SF300); after, I configured it for customer environment (LAN IP address, WAN configuration, rules, hosts, etc.); at the end, I created and downloaded the configuration backup.

I tried to RESTORE, successfully, my Sophos XG Home configuration on customer’s XG

I tried to upgrade the firmware to version 18 and it started with the DEFAULT FACTORY configuration (Administrator password remained set)

I also tried to RESTORE the XG HOME configuration backup on version 18, but it didn’t work (I was able to restore, but, at the restart, it was still with the default factory configuration)

So I rollback the firewall, loading the other firmware image directly via GUI, and the configuration was back (and running, but on firmware 17.5.10-MR10)

Then I RESTORED the customer configuration, just created, on version/image 17.5.10-MR10 and it was OK; I updated the firmware version to the 18 and it was OK

I rolled back (boot) again to the version 17.5.10 using the second image on firewall, I RESTORED the XG HOME configuration and I tried to upgrade the firmware version to 17.5.11-MR11 just downloaded on the Sophos site, and IT WORKED WELL; it restarted with the firmware version 17.5.11-MR11 with the correct configuration.

So, I tried to UPGRADE (and boot) to the firmware version 18 and the firewall/GUI showed a message saying “It will restart with the default configuration, do you want to proceed?”

CONCLUSION:

The configuration of XG HOME firewall runs perfectly on version 17.5.10 and 17.5.11 (both on XG HOME device and on XG115 device), but cannot be migrated to the version18; I think there is something in these settings which the UPGRADE of firmware version 18 is NOT ABLE to RUN; in other words, the firmware 18 is NOT ABLE to migrate all parameters set and so it starts on factory default settings; migrating from the version 17.5.11-MR11, the issue persists, but is shown a message.

Is there a way to debug/understand why (or which part of configurtion)?

Many thanks in advance and best Regards

Giorgio

This thread was automatically locked due to age.

Parents

0 Keyur over 5 years ago

Hi Giorgio Premoli1

As per our discussion on twitter, request you to share the backup file from v17 and also open a service request and share the service request number you will receive from the support.
Cancel
Vote Up 0 Vote Down

Cancel
0 Giorgio Premoli1 over 5 years ago in reply to Keyur

Case number #9822103

Many thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Big_Buck over 5 years ago in reply to AndréAegerter

Hello

Much of the same here. Importing from backup have allways been an act of faith with XG. And particularly since they decided to lock it with a password. It fails 80% of the time. As far as I am concerned, it works only when it is very recent.

Paul Jr
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to AndréAegerter

Quite simple: As V18.0 MR1 is not released yet, there is no migration path.

https://community.sophos.com/products/xg-firewall/b/blog/posts/xg-firewall-v18-mr1-is-now-available

https://community.sophos.com/kb/en-us/135378

V17.5 MR11-12 need V18.0 MR1 to upgrade, as most of the stuff in V18.0 are renamed and can not be migrated.

Hence the Migration via API/XML does not work for everything.

About this WAF Issue, i would recomemnd to open a new thread with Screenshots, as i cannot follow up your issue.
Cancel
Vote Up 0 Vote Down

Cancel
0 AndréAegerter over 5 years ago in reply to Big_Buck

thank you for answer. encrypting backups with a password makes sense or not? What do you mean? Sophos has a problem with that? (for accept the Backup Image an so on)
Cancel
Vote Up 0 Vote Down

Cancel
0 AndréAegerter over 5 years ago in reply to AndréAegerter

Hey Toni

That means I have to wait until a newer 18 version appears?
Toni, you again? but you can be seen here very often, I'm glad :-)

Yes, i think, i must open a new area for my Microsoft Active-Sync Problem.
But you didn't say anything that my firewall might have been hacked? So, this is also a reason to upgrade my Sophos XG or: Reinstall with the same Image and then make a restore the backup.
Cancel
Vote Up 0 Vote Down

Cancel
0 Big_Buck over 5 years ago in reply to AndréAegerter

Makes sense when it is implemented properly. With XG, thousands of things can go wrong, and sure enough, when it fails the error message is clueless.

And you cannot opt out encrypting.

Paul Jr
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to AndréAegerter

You should use V17.5 MR12 for an new installation. Restore the Backup should work smoothly.

Only the import into V18 does not work (right now).

So please reimage your installation with V17.5 MR12.

https://community.sophos.com/products/xg-firewall/b/blog/posts/xg-firewall-17-5-mr12-released

Install V17.5. Complete the wizard until you get into the webadmin.

Wait some minutes to get the latest Hotfixes installed.

Import the backup with the Encryption password.
Cancel
Vote Up 0 Vote Down

Cancel
0 AndréAegerter over 5 years ago in reply to LuCar Toni

All right. The post for Active Sync is coming, but not today ;)
First, i will reinstall my Sophos with the same Version of Image. Maybe in a few days ...
Cancel
Vote Up 0 Vote Down

Cancel
0 AndréAegerter over 5 years ago in reply to LuCar Toni

you don't believe it. Just reinstalled the Sophos firewall (with this ISO File: SW-17.5.12_MR-12-664.iso), all settings are deleted, only the following are not: Point Protect/ Web Server/ Protection Policies.During the reinstallation process, the following message appeared: Formatting ... This is complete curd, otherwise EVERYTHING on the hard disk would have been deleted or not?

I suspect, as often mentioned in the post, that my firewall was hacked. Thus, the settings have probably been moved to another partition, which apparently is not captured by the reinstallation! I now have to remove my hard drive and manually connect it to my PC and delete it in this way, but completely!

That is my explanation, incredible :-(
Cancel
Vote Up 0 Vote Down

Cancel
0 Giorgio Premoli1 over 5 years ago in reply to AndréAegerter

I think that the migration from 17.5.12 to v.18 is not yet ready. If you try to migrate, the configuration is lost and reset to the factory default (remember that the admin password is not reset, remains the current set before the migration).

It happens also if you set a new configuration (on new applicance) on V17.5.12 and you migrate to v.18; so I don't think your appliace has been hacked.

I decided to await to migrate our customers' firewall on version 18 as far as the new firewall firmware will appear automatically on the proposed firmware upgrade.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to Giorgio Premoli1

It is not support right now.

https://community.sophos.com/products/xg-firewall/b/blog/posts/xg-firewall-v18-mr1-is-now-available

https://community.sophos.com/kb/en-us/135378
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LuCar Toni over 5 years ago in reply to Giorgio Premoli1

It is not support right now.

https://community.sophos.com/products/xg-firewall/b/blog/posts/xg-firewall-v18-mr1-is-now-available

https://community.sophos.com/kb/en-us/135378
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data