XG Firewall Home registration assistance... trying to upgrade to newer hardware

Hi Rick Dunn 

As per your issue description the new hardware SFVH (SFOS 17.5.11 MR-11.HF051220.1) having an issue with registration fails.

But the license.log which you have pasted here seems to be from SF01V (SFOS 17.0.6 MR-6).

INFO May 13 08:44:31 [0]: --upgradedFrom = 0
INFO May 13 08:44:31 [0]: --fwversion = 17.0.6.181

Is this logs belongs to old hardware or the new one running with (SFOS 17.5.11 MR-11.HF051220.1)? 

If possible then provide direct Internet to device SFVH (SFOS 17.5.11 MR-11.HF051220.1) rather then keeping it behind another one and check the registration status and share the logs in this scenario if the issue persist.

I did try this direct connected to the cable modem before I got the Serial Number registered under my account last night, see below. I can try again this evening...

The new hardware only boots from the old firmware, the new firmware says no bootable device... hoping to get this registed on this firmware and upgrade over the web process.

INFO May 12 22:27:33 [0]: --requestType = 1 
INFO May 12 22:27:33 [0]: --serial = C01001RTVM*****
INFO May 12 22:27:33 [0]: --deviceid = 8b8bc4b6-3a25-48a8-8311-39374790****
INFO May 12 22:27:33 [0]: --model = SF01V
INFO May 12 22:27:33 [0]: --vendor = SO01
INFO May 12 22:27:33 [0]: --upgradedFrom = 0
INFO May 12 22:27:33 [0]: --fwversion = 17.0.6.181
INFO May 12 22:27:33 [0]: --cert = /_conf/certificate/licensing/mfgr_vendor_SO.pem
INFO May 12 22:27:33 [0]: --token = Token-Id:SO-D5C0****
INFO May 12 22:27:33 [0]: --key = /_conf/certificate/licensing/mfgr_vendor_SO.key
INFO May 12 22:27:33 [0]: URL : eu-prod-utm.soa.sophos.com/.../applianceactivation
INFO May 12 22:27:33 [0]: request : { "serialNumber": "C01001RTVM22331", "deviceId": "8b8bc4b6-3a25-48a8-8311-39374790****", "model": "SF01V", "deviceFirmwareVersion": "17.0.6.181", "vendorCode": "SO01" }
INFO May 12 22:27:34 [0]: response : {"errorCode":"ITSERVICELAYER_CLIENT_AUTHENTICATION_ERROR", "message":"IIS error: HTTP 403.0 - Forbidden", "statusCode": 403}
ERROR May 12 22:27:34 [0]: Activation Failed : IIS error: HTTP 403.0 - Forbidden
ERROR May 12 22:27:34 [0]: licensing_do_activation() : parsing failed...
INFO May 12 22:27:51 [0]: --requestType = 1
INFO May 12 22:27:51 [0]: --deviceid = b8be52ec-ee00-4509-9eee-558d2c3f****
INFO May 12 22:27:51 [0]: --model = SF01V
INFO May 12 22:27:51 [0]: --vendor = SO01
INFO May 12 22:27:51 [0]: --upgradedFrom = 1
INFO May 12 22:27:51 [0]: --fwversion = 17.0.6.181
INFO May 12 22:27:51 [0]: --cert = /_conf/certificate/licensing/mfgr_vendor_SO.pem
INFO May 12 22:27:51 [0]: --token = Token-Id:SO-D5C0****
INFO May 12 22:27:51 [0]: --key = /_conf/certificate/licensing/mfgr_vendor_SO.key
INFO May 12 22:27:51 [0]: URL : eu-prod-utm.soa.sophos.com/.../applianceactivation
INFO May 12 22:27:51 [0]: request : { "deviceId": "b8be52ec-ee00-4509-9eee-558d2c3f****", "model": "SF01V", "deviceFirmwareVersion": "17.0.6.181", "vendorCode": "SO01", "upgradedFrom": "SOPHOS" }
INFO May 12 22:27:52 [0]: response : {"errorCode":"ITSERVICELAYER_CLIENT_AUTHENTICATION_ERROR", "message":"IIS error: HTTP 403.0 - Forbidden", "statusCode": 403}
ERROR May 12 22:27:52 [0]: Activation Failed : IIS error: HTTP 403.0 - Forbidden
ERROR May 12 22:27:52 [0]: licensing_do_activation() : parsing failed...

Has there been a change on the licensing back end to disable firmware version :  17.0.6.181 the ability to register??

Hi,

please check the time of your XG.

Ian

I was looking over the licensing.log file and also checked the /_conf/certificate/licensing/mfgr_vendor_SO.pem used to encrypt the conversation ( SSL ) for the update/registration and I find the Cert has expired on the 17.0.6 MR-6 version I have booted from ...

SF01V_SO01_SFOS 17.0.6 MR-6# more /_conf/certificate/licensing/mfgr_vendor_SO.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 6 (0x6)
Signature Algorithm: ecdsa-with-SHA256
Issuer: C=GB, ST=Oxfordshire, L=Abingdon, O=Sophos Ltd., OU=NSG, CN=Sophos Firewall Content/Licensing CA/emailAddress=updates@sophos.com
Validity
Not Before: Apr 27 05:09:54 2015 GMT
Not After : Apr 26 05:09:54 2020 GMT     <<<<<<  expired  >>>>>>

... Is it possible to update the cert on this build to allow me to properly register my install ?  if so please provide the method...

Thanks

Hi Rick,

I can't answer you on the renewal but you could try regenerating the certificate on the XG and see what happens.

Ian

How do I  regenerate this cert?  Need the command(s) syntax to do so...

Hi Rick,

you go to Certificates -> certificate authorities -> SecurityApplicance_SSL_CA -> the cogged wheel will regenerate.

Ian

OK we are getting closer to resolving this however .. I did run the Cert Update thru the cogged wheel ... It is showing updated in the GUI, pic attached... I rebooted the FW .. retried and failed. Is there another procedure to get the cert being used for registration to use the updated cert??

In the advanced console I checked the logs and cert and the cert being used for the registration did not get the update..

INFO May 14 06:32:05 [0]: --token = Token-Id:SO-D5C0****
INFO May 14 06:32:05 [0]: --key = /_conf/certificate/licensing/mfgr_vendor_SO.key
INFO May 14 06:32:05 [0]: URL : eu-prod-utm.soa.sophos.com/.../applianceactivation
INFO May 14 06:32:05 [0]: request : { "serialNumber": "C01001MX9QP3GA1", "deviceId": "658f3498-47d7-4f8a-9c40-f7888c4*****", "model": "SF01V", "deviceFirmwareVersion": "17.0.6.181", "vendorCode": "SO01" }
INFO May 14 06:32:06 [0]: response : {"errorCode":"ITSERVICELAYER_CLIENT_AUTHENTICATION_ERROR", "message":"IIS error: HTTP 403.0 - Forbidden", "statusCode": 403}
ERROR May 14 06:32:06 [0]: Activation Failed : IIS error: HTTP 403.0 - Forbidden
ERROR May 14 06:32:06 [0]: licensing_do_activation() : parsing failed...

~
SF01V_SO01_SFOS 17.0.6 MR-6# more /_conf/certificate/licensing/mfgr_vendor_SO.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 6 (0x6)
Signature Algorithm: ecdsa-with-SHA256
Issuer: C=GB, ST=Oxfordshire, L=Abingdon, O=Sophos Ltd., OU=NSG, CN=Sophos Firewall Content/Licensing CA/emailAddress=updates@sophos.com
Validity
Not Before: Apr 27 05:09:54 2015 GMT
Not After : Apr 26 05:09:54 2020 GMT
Subject: C=GB, ST=Oxfordshire, O=Sophos Ltd., OU=NSG, CN=SF_Manufacturer_6/emailAddress=sf_manufacturer_6@sophos.com
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey

Hi Rick

Please read through this forum thread it might provide some information.

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/120338/problems-with-appliance-cert-change-to-a-new-one

Ian

Hi Rick

Please read through this forum thread it might provide some information.

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/120338/problems-with-appliance-cert-change-to-a-new-one

Ian

rfcat_vk said:

Hi Rick

Please read through this forum thread it might provide some information.

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/120338/problems-with-appliance-cert-change-to-a-new-one

 

Ian

 

Thanks for the link.. I am trying to get the Appliance Cert updated to use a valid SSL cert for registration... this link alludes to using a custom SSL appliance Cert. 

I updated the SecurityAppliance_SSL_CA via web GUI however the Cert being used to register wasn't updated during that procedure.

I also updated the appliance cert...

I did follow the link SYSTEM -> Administration -> Port Settings for Admin Console .. Certificate drop-down ( Only has ApplianceCertificate ) and chose apply... Going to reboot again to see if that updates the 

/_conf/certificate/licensing/ folder to reflect the certs for the device... until this is updated I don't believe I can get this box registered... Or am I wrong???