Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 29 subscribers
  • Views 632 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

New XG125 w/ V4 Firmware

Robert Mitchell

SOPHOS ISSUES   XG125 New Oct 2020

1) Extremely and I mean EXTREMELY slow admin interface.   Approx 15-30 seconds each and every time you make a change to any parameters before it is completed writing it, and refreshing the screen.   You need to plan carefully because if you have a dozen or more rules to add, it takes quite a long while to enter.

2) Screen does not allow enough space to see the name of the Address object it cuts off after 3rd segment, ie.  192.168.100.    so you must mouse over each and every rule to find the right rule.   Very time consuming and needless.   Allow full width of the screen and the problem is solved.

3)  WIth 21 rules added and associated NATs entered, the XG is showing 78% memory usage.  What??   Why, I haven't entered any VLAN information yet.  What happens when it is 90,95 or more % filled does it just keel over?

4) It takes MINUTES to reboot, plan carefully because you will be offline for at least 5-6 minutes.

5) Right out of the box, could not configure 100/FULL Duplex, could not get WAN Link light.   Had to configure it 1GBe/FULL and pay the extra at the hosing facility. OK perhaps that is fine, but WHY?

6) VPN,  Cannot select from multiple VPN END POINT .   Meaning, if you have more than one location, you must rename the configuration file and use the configuration file specific the the End point you want to connect to.   Someone really has to be kidding with this one, it is not 1971 is it?

7) High CPU usage 50,65,80% CPU and the unit is not even active yet.  WHY?   It settles down after while to 10,20% but what is it doing during the other moments.   Again no traffic yet.

8) Some NAT Rules seem to go offline after 15-20 minutes and need to be resaved and take effect again for 15-20 minutes.   Not all of them, just some of them.  What?  Again how could that even be possible and really raises concerns about this particular device quality.   Regardless paying extra to have the authorized reseller research the issue but can't turn this on this way.

POSITIVES

     Country blocking interface is easy to configure and worked reasonably well.   But not certain the SOPHOS Country IP list is really up t date, because it is letting through some that are "Blocked" zones.

     Cost, it was cheaper than all of the other manufacturers at similar hardware levels by 30%.   Got me to buy it, but see issues...is it worth the extra trouble?

     Some reporting seems better than others like Sonicwall, CISCO ASA (who's reporting is really quite inadequate by default), but Sonicwalls don't have the other 8 problems above and we have had a dozen of them of all sizes.

     Colors on the graphs are nice, but what pertinent information am I getting with those graphs?

Lastly, all of this having been said.   There might be corrections available for #5, #6, #8.   But the others seem like something we would have to just live with...not sure that is reasonable to and very uncomfortable putting any load on this with CPU and Memory where it seems to be.   We have a SG125 also that we loaded the XG software onto as well...same thing (except #8 not happening).



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    how much memory is your 125 configured with?

    For the WAN interface try using auto rather than manual configuration.

    The XG GUI is not the fastest in the world, that is why I went back to my e3 for home use over the Atom based low power unit.

    Boot time even on my e3 takes about 3-5 minutes.

    Why do you need all the NAT rules, in most cases for external access a generic MASQ rule will suffice.

    Country blocking is quite good, but please remember that some companies from blocked ccounties use MS or AWS servers in non-blocked countries, yes a right royal pain.

    Sound like you might have needed a 135.

    Ian

  • 0 in reply to rfcat_vk

    Thank you for the quick response Ian.    I purchased recommended unit from firewalls.com did not occur to me that it would have less memory than an Iphone 4.   Possibly it can be upgraded.   XG GUI is not fastest is understatement i think.  If you have also used virtually any other similar unit from any other manufacturer, you would have a completely different opinion I think.    Essentially this appears to be the same hardware we purchased in 2016.  We at that time had issues with the UTM and switch back to a Sonicwall 2400.   However, was giving SOPHOS one more try because FW(s).com said worked well.    NAT rules are because we have multiple websites along with QA and DEV regions, 5 + 5 + 5, + Email server etc, Plus country blocking.   Again I know, 135...but SW2400 has far less advertised throughput and worked fine for 4 years.   So $ for $ Sophos more expensive if I am counting my chickens.   And as far as country blocking, I have software on the webservers because Russia, China, Ireland, Netherlands have been hammering our servers to break in, so software on the servers is catching the remaining.

    But thank you for your thoughts.   I am more thinking that SONICWALL has the upper hand here.   Given apples to apples, TZ400 etc... with a newly acquired test TZ400, none of these issues came up...none.

    I provided my experience in hopes of helping some other poor, unassuming operator to avoid the same headaches I have experienced with both the original SG and the newer XG appliance.

    Best Regards,

    Robert

Reply
  • 0 in reply to rfcat_vk

    Thank you for the quick response Ian.    I purchased recommended unit from firewalls.com did not occur to me that it would have less memory than an Iphone 4.   Possibly it can be upgraded.   XG GUI is not fastest is understatement i think.  If you have also used virtually any other similar unit from any other manufacturer, you would have a completely different opinion I think.    Essentially this appears to be the same hardware we purchased in 2016.  We at that time had issues with the UTM and switch back to a Sonicwall 2400.   However, was giving SOPHOS one more try because FW(s).com said worked well.    NAT rules are because we have multiple websites along with QA and DEV regions, 5 + 5 + 5, + Email server etc, Plus country blocking.   Again I know, 135...but SW2400 has far less advertised throughput and worked fine for 4 years.   So $ for $ Sophos more expensive if I am counting my chickens.   And as far as country blocking, I have software on the webservers because Russia, China, Ireland, Netherlands have been hammering our servers to break in, so software on the servers is catching the remaining.

    But thank you for your thoughts.   I am more thinking that SONICWALL has the upper hand here.   Given apples to apples, TZ400 etc... with a newly acquired test TZ400, none of these issues came up...none.

    I provided my experience in hopes of helping some other poor, unassuming operator to avoid the same headaches I have experienced with both the original SG and the newer XG appliance.

    Best Regards,

    Robert

Children
  • 0 in reply to Robert Mitchell

    Hi Robert,

    I have extensive experience with the UTM, but that was really before Sophos took over and it was a very responsive GUI. I have also use Pal Alto and Cisco and still find the XG GUI extremely slow. My machine has a mix of IP4 and IPv6 and around 45 active rules. With country blocking are you dropping or rejecting in the firewall rule, drop is preferred.

    Ian

    Also are you sending the bad countries to a deadend address?

  • 0 in reply to rfcat_vk

    Hi Ian,

        Yes I do appreciate your experience.   Yes dropping because no reason for rejected countries to have any information at all.   I also thought the UTM was a decent device and it worked as advertised for the time we had it, however the VPN single endpoint connection drove the network folks nutz so we changed back to SW for our multiple locations.  I was just really taken aback that after 4 years, the XG unit is so lacking in both usability and performance, it actually is stunning.   I guess my expectations were just assumptions that it would have made positive progress not negative.   Having a specific business budget for hardware, we attempt to get the best value for our available $ each year.   However, this time, we are just about ready to throw in the towel and move back to Sonicwall, whatever the expense it's worth the reduced time and effort we have been putting in trying to get these devices fully functional.   There are going to be a couple of lightly used (like never), SG125 and XG125 available on Ebay soon ;)

    Best Regards,

    Robert