RED remains disconnected/non-functional after XG update and reboot

Hi Tom Kramer,

Thank you for reaching out to the Community! 

Could you please provide a firewall and RED model number and running firmware version on it? 

I would also suggest you open a support case for further investigation and send me the case number via PM so that I can help with the followup. 

Thanks,

Hello,

- XG 210

-> Update from SFOS 17.5.12 MR-12 to SFOS 17.5.13 MR-13. However, the problem already existed in update to SFOS 17.5.12 MR-12.

- RED50

-> Firmware 2.0.019. Now the appliance has been updated to 3.0.002.

-----

We had already used the payed support for our XG in the past. Unfortunately it turned out that it was an absolute waste of working time. Ultimately, after a while, the community provided the solution.

Hello,

- XG 210

-> Update from SFOS 17.5.12 MR-12 to SFOS 17.5.13 MR-13. However, the problem already existed in update to SFOS 17.5.12 MR-12.

- RED50

-> Firmware 2.0.019. Now the appliance has been updated to 3.0.002.

-----

We had already used the payed support for our XG in the past. Unfortunately it turned out that it was an absolute waste of working time. Ultimately, after a while, the community provided the solution.

I can confirm this bug. We had this with dozends of REDs after going from 17.5.12 to 18.0.1.

But we already had this when upgrading to 17.5.12.

So this should be nothing new to Sophos.

Thanks ^^

Never heard of this issue nor saw it on my appliances before. 

So you upgrade the firmware of XG, but not the RED Firmware and all your REDs cannot connect until you reload the configuration? 

Can you show us a example configuration of one RED? 

Do you use a DNS Hostname for the RED to find XG? 

In our case IP and at the last RED changes in our topology we noticed it for RED50 with VLANs enabled on the RED side.

Had to edit the settings in the VLAN adapters and click save without changes.

one of the VLANs:

Hello,

"So you upgrade the firmware of XG, but not the RED Firmware and all your REDs cannot connect until you reload the configuration? " 

-> I can now only confirm that two-way network communication was no longer possible until we reloaded the configuration. In order for the RED to notice this reload, at least a connection to our XG must have existed.

Here is our RED-Config

Confirm: connection is up but no traffic flowing until config reloads

So the VLAN is essentially broken, after an update? 

Do you have multiple VLANs configured and is only RED50 the affected ones? Same for RED15/20? 

Which Switch Mode do you use? Is it always VLAN Mode on the ports? 

The VLAN is not functional after update and/or after initial creation.

Last thing was to move a RED50 from a SG to a XG. After everything was set up, no communication was possible until we resaved the VLAN Interfaces on the RED.

Only RED50 devices have VLANs attached in our environment and so the Port is in VLAN mode.

Hello,

now the update to HW-17.5.14_MR-14-1.SF300-714 is ready.

Should I pay attention to special things or collect logs to get closer to the problem?


Best regards

You could do something, as i did not have the time to reproduce this.

The issue could be caused by the RED or the XG. 

After the update, the Interface and all VLANs should be there. The Interface should be plugged. You can verify both via #ifconfig and #ethtool 

You can verify via Tcpdump, if the RED is sending the traffic with VLAN tags or not. See: https://access.redhat.com/solutions/2630851