Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 442 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG135 v2 to v3 migration with export/import results in brick

Rob Clifton-Harvey

Hello, and forgive me if I sound a bit annoyed, but I spent the entire night on something that should be a triviality, and it still doesn't work.

We have an XG135 rev2 that works just fine, about 15 employees connect to it using RED devices, and we have 3 AP55 WiFi-boxes in our office LAN.

Now we got the newer XG135 rev3 model, and it does nothing but screw around and not-do what it's supposed to.

I understand from various official help documents and other threads in this forum, that migrating an XG135 v2 to an XG135 v3 should work, and also without a lot of trouble, since neither device is "old generation" SG, and both devices have the same kinds and counts of ports, interfaces, etc.

So I connect to the old XG135's web interface, check that the firmware is the latest, currently SFOS 18.0.3 MR-3, everything's up to date. I set up the Secure Storage Master Key that is now being pressured on me before the export reeeally exports everything. I do a full export, saves a file of about 2 MB to my drive.

Then I connect to the new XG135, check that its firmware is the latest, currently SFOS 18.0.3 MR-3 as well, everything up to date. I go to the Import/Export page, browse to the full export file I just got from the old XG135, I enter the Master Key and off it goes. After a while it displays a message, words to the effect of "this will take a while, do whatever you want, check import progress in Log Viewer". Cool, so that I do.

Takes about an hour, maybe longer, but at some point I check the Log Viewer and it tells me the file was imported, which to me means "done."

Via the new XG135's web interface, I see things like the clientless users from the old XG135, I see the imported firewall rules, I see some device user accounts, I see a bit of imported this and that.

There should be 15 RED boxes and 3 WiFi Access Points known/associated, yet it displays "0/0" REDs and "0/18" (or 0/15?) APs in the Control Center.
In the "Wireless / Access Points" list, it shows all the APs of the RED boxes known to the old XG135, and it shows the 3 WiFi APs as "pending".
In the "Wireless / Wireless Networks" and "Wireless / AP Groups" lists, it just shows some default pre-installed Sophos entries, but nothing that was on the old XG135.
In the "Network / DHCP" list, it shows exactly 0 of the previously 15 DHCP pools associated with the various REDs that go through the old XG135.
In the "Network / Interfaces" list, it shows just about nothing. No "port 5-8 LAG", no "trunk+port1+port4" bridge interface, no REDs, nada.

I think, "hm - maybe it just needs a reboot".
So I reboot it from the web interface, give it 10 or so minutes to do its thing, and it becomes a brick.

Web interface no longer reachable, none of the LAN port LEDs light up, no matter what I plug into where, no matter whatever I configure on the other end.

I can hook it up to a switch via ports 1 or 4, which are in the (theoretically imported) interface bridge with the (ports 5-8) trunk/LAG, but not part of the actual trunk/LAG, but none of the port LEDs on the front even light up. I can connect my computer directly, machine to machine, just a cable in between, set my computer to DHCP, set my computer to a fixed IP in our office LAN range, set my computer to an IP in the XG135's default IP 172.16.16.x range. But alas, nothing. None of the Link/Activity LEDs on the LAN ports ever light up or even flicker.

Before importing (again), all the LAN ports work just fine, I can connect from my computer directly, or through a switch, and I can reach the new XG135's web interface. After importing (again), all the LAN ports are dead.

I hooked it up to an HDMI screen and a USB keyboard, so at least I could stumble my way through the console menu.
None of the LAN ports seem to be assigned, after importing, only the WAN port (#2) has the fixed IP that it should have, apparently imported from the old XG135.

So I connect my computer directly to the WAN port with a manually assigned IP in the range of the (theoretical) WAN-side network, and voila - port 2 LEDs light up, Link glows, Activity flickers. I can SSH to the device and enter its menu.

All I can do from there is "rollback_to_17" or whatever through the console, "reset to factory", start over. Then install the latest SFOS 18.0.3 MR-3 firmware again, reboot. Import the old configuration, wait 1 hour plus, see "was imported" in Log Viewer, reboot, brick.

One time after rebooting, I accessed the new XG135 via HDMI/USB. I entered the correct password, ended up in "Main Menu", tried to do something, but it told me to wait because the device is still getting ready. After a minute or so, I tried again, but it displayed "authorization failed", and from that point on, it would not accept the correct password anymore.
I tried all the password combinations this device ever saw, from admin/admin and the spelling if the keyboard layout were regionally correct, to the spelling with the default UK/US layout, and even various Caps Lock on/off combinations. Nothing did it.
Mind you, I could still log in via port 2/WAN and SSH remotely, using the exact same password I had unsuccessfully entered about 500 times in all sorts of flavours just a few seconds ago, and that let me do a "rollback_to_17" and start over. But no access directly through HDMI/USB anymore.

At one point I also did a "selective export", and selected ALL the 2912 or so individual little entries in the list, hoping that it might export/import the missing things like RED interfaces if maybe I forced it by selecting them explicitly, but also no success. Same as the other times. Partial configuration, dead LAN ports, brick.

Amazing experience so far. :)

And that's the current state. I've been through the above process about 4 times this night. Nothing will work. Once imported, all the LAN ports go dead.
Surely exporting/importing between a rev2 and rev3 of the exact same device model shouldn't be that big of a deal?

So what gives?
Anyone have an idea what's going on, or what's not going on?
Thankful for any hint or help.



This thread was automatically locked due to age.
Parents
  • 0

    Let me get some points: 

    First of all, we recommend the Backup / restore approach, if possible. See: https://support.sophos.com/support/s/article/KB-000036245?language=en_US This should import everything within minutes and the new configuration should be available. 

    The difference between Backup/Restore and Import/export is quite simple: Backup/restore is build to restore a configuration, the appliance will take the backup and restart with the new config. Import/export was build to import/export configurations "on the fly" while the appliance is working. Its like a API, which can do all manual work automatically. If you look at the .tar, you will see a XML File, which basically contains all changes. But as this approach does not reboot, it has to do everything in a sequence base. So likely it was not ready after an hour, if you import "everything", because there was much config in it. 

    Another point: You can RESET the password on HDMI/Keyboard by simply pressing "RESET" and Enter into the password field. It allows you access to the appliance for recovery. See: https://support.sophos.com/support/s/article/KB-000035990?language=en_US

  • 0 in reply to LuCar Toni

    Thank you kindly for your suggestions. I'll try the Backup/Restore approach the next time, and see how it goes.

    I did wait for the Log Viewer to display the message that suggested to me the Import process was complete. It was something like 'done importing file' or 'imported from file' or so, unfortunately I don't remember the exact phrasing. Before that message, there was an incessant stream of 'admin did this', 'admin did that' messages, making changes to all sorts of things, and after the 'file imported' message showed up, nothing happened anymore in the admin log, which was confirmation enough for me that the import should've been complete.
    The constant flickering of the blue hard drive light had also stopped, or rather gone back to sporadically giving off one short flicker.

Reply
  • 0 in reply to LuCar Toni

    Thank you kindly for your suggestions. I'll try the Backup/Restore approach the next time, and see how it goes.

    I did wait for the Log Viewer to display the message that suggested to me the Import process was complete. It was something like 'done importing file' or 'imported from file' or so, unfortunately I don't remember the exact phrasing. Before that message, there was an incessant stream of 'admin did this', 'admin did that' messages, making changes to all sorts of things, and after the 'file imported' message showed up, nothing happened anymore in the admin log, which was confirmation enough for me that the import should've been complete.
    The constant flickering of the blue hard drive light had also stopped, or rather gone back to sporadically giving off one short flicker.

Children
  • 0 in reply to Rob Clifton-Harvey

    Import/Export is some sort of " https://en.wikipedia.org/wiki/Salami_tactics ". You add some configuration changes on the fly and if those changes include "alot" some modules could actually does not import everything.

    So the "Import successful or failed" part is only the "End sequence". For example if you import 5 objects, but one fails  for what ever reason, the import in total was successful, but one object had an issue. 

    There is a feature request on the backlog to improve this feature, but actually this is quite rarely used for your use case. Most customers used Backup/Restore for such matters.