Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 11 replies
  • Subscribers 29 subscribers
  • Views 933 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Changing from UTM to XG

ChriZathens

Hello to all!

Since a few days I am evaluating XG in order to replace my UTM

I have been running Sophos UTM for the last 5+ years, have been extremely pleased with it, but I started considering to move on.

So installed XG on a second machine I have...

I find XG's logic more... logical to be honest, but this does not mean that I can necessarily follow this logic, especially for someone like me who has been spoiled for so many years  with the UTM's user friendliness.

Anyway, my use case is the below:

One WAN connection using PPPoE with a 3G failover. (I will soon be adding a second WAN connection via a WISP, but that is a matter for another day)

I have a few NAT rules to access some non important services remotely. I use VPN to access  securely my important stuff

I have a couple of VLANs for guests and IoT devices.

I also have 3 dynamic dns hostnames that point to 3 different machines on my internal network.

I use Advanced threat protection, web filtering and application control in order to block ads and access to bad sites (aka young kids)

Also a few web filtering profiles to block internet access using some criteria (e.g. kids tablets during specific hours, IP cameras etc)

So I started my tests to see how I can transfer my configuration to XG. Not a dead easy task, XG wan port is now connected to the guest network, so cannot simulate my PPPoE WAN and have this as DHCP. I assume PPPoE will have no issues, though, will just need to change the interface type when I decide to go in production.

I also checked NAT options. After a quick look I realized that while on the UTM I was creating 2 rules (DNAT and Full NAT) in order to access from inside using the "external" address, now on XG it is only a checkbox to enable this option. Really nice (unless I was stupid with my UTM config and dual rules were not needed, that is)

VLANs also are straight forward on XG, as I see, and the usage of Zones makes things much more organized IMHO.

The log is another thing... Pardon me, but the one on the UTM was not good. Especially since there were essentially no filtering options, trying to find something using the available method was simply a pain. In XG things appear to be much easier in this regard. Of course I will clearly find out when I go live with XG, because in my test environment I have for starters only one machine behind XG, so not the same thing

I then went on to the DynDNS thing. I am accustomed to the UTM logic where I was adding the dynamic dns account, then on webserver protection creating real webservers, then the virtual ones and was assigning the dyndns host to the virtual webserver.

I did not see the same approach on the XG... how does this work in XG? Not entirely clear to me, granted I only played a few hours with it, so will have to explore more I guess. Searching about this, however, I realized that everything I could find was about the new feature where sophos can be used as a DDNS server. (BTW does this mean I can discard what I have now and use sophos for 3 or more hostnames that I need?)

An important question: Is something important still missing from XG compared to UTM features? (I remember in the past reading posts about some missing features that were deal breakers for some users. But I can't find those any more and additionally XG has evolved a lot since then and said features may be already added by now)

A thing that it is missing and it bothers me is the lack of UPS management. Having this I know it is not extremely important in a firewall and UTMs implementation was pretty basic anyway. Nevertheless, the ability to gracefully shutdown the machine was nice to have. Additionally, the notifications of a power loss via email was a good piece of information. I liked that even when I was away I was still aware of power issues at my house. Do you think it will ever be added to XG? I hope so, even at the basic form UTM had it.

Another thing... The test machine I have now is using a Haswell core i3-4130 CPU with 8GB of RAM ( I know 6 is only used in Home edition). So it is powerful enough. My actual firewall has an Atom C2358 with 4 GB of RAM (it can be upgraded to more RAM if needed). Do you thing it can handle XG with the same stuff running in the background as UTM does?

Is there anything else I should be aware of before I make the transition, or after my transition?

Thanks in advance for all your comments/answers!!



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    I am using SG and XG at work. I have also knowlege of fortigate.

    I think in your scenario you can use SG and XG.

    In bigger environments like ours with a new project there is no other option than using XG as the EOL of SG is coming some time and everything new and the central management is developed in XG. In home use there might be no need to migrate to XG unless you need a feature that is not available on SG.

    We had some issues with XG in 17.5 (stability of IPSec Tunnels; clustering an licensing) and some weird behaviour on 18 MR-1 to MR-4 (especially with teams communication and REDs). XG definitely needs more ressources on comparable hardware. The change from 17.5 to 18 MR-4 was a big step with a lot of feature enhancements. I think everything before 17.5.x was a mess ...

    However there are still a lot of things missing you know from firewalls like SG and Fortigate.SG and Fortigate have good logging, excellent search functions and you can see where an object is referenced. The documentation of fortigate is excellent but XG documentation is getting better (slowly). The performance of fortigate is much better as they have implemented some stuff in specialised hardware whereas XG only uses plain computer hardware. The support of XG was bad and is getting better (slowly).

    If you like playing around with these things migrate. If not stick to SG for another 1 - 1 1/2 years and migrate then. Things are moving slowier and are less stable than we expected when we migrated the first firewall from fortigate to XG in autumn 2019. Meanwhile we also migrated some other SG sites and implemented new sites.

    Best regards
    BeEf

Reply
  • 0

    Hi,

    I am using SG and XG at work. I have also knowlege of fortigate.

    I think in your scenario you can use SG and XG.

    In bigger environments like ours with a new project there is no other option than using XG as the EOL of SG is coming some time and everything new and the central management is developed in XG. In home use there might be no need to migrate to XG unless you need a feature that is not available on SG.

    We had some issues with XG in 17.5 (stability of IPSec Tunnels; clustering an licensing) and some weird behaviour on 18 MR-1 to MR-4 (especially with teams communication and REDs). XG definitely needs more ressources on comparable hardware. The change from 17.5 to 18 MR-4 was a big step with a lot of feature enhancements. I think everything before 17.5.x was a mess ...

    However there are still a lot of things missing you know from firewalls like SG and Fortigate.SG and Fortigate have good logging, excellent search functions and you can see where an object is referenced. The documentation of fortigate is excellent but XG documentation is getting better (slowly). The performance of fortigate is much better as they have implemented some stuff in specialised hardware whereas XG only uses plain computer hardware. The support of XG was bad and is getting better (slowly).

    If you like playing around with these things migrate. If not stick to SG for another 1 - 1 1/2 years and migrate then. Things are moving slowier and are less stable than we expected when we migrated the first firewall from fortigate to XG in autumn 2019. Meanwhile we also migrated some other SG sites and implemented new sites.

    Best regards
    BeEf

Children
  • 0 in reply to BeEf

    Hello!

    Thanks for your insights

    Had tested again XG about two years ago and I made the decision to stick to the UTM at the time. However now that I tested again seems much more mature, that's why I considered the migration.

    But I finally decided to wait a bit longer. I think it is not the correct timing right now (with kids having school class remotely and the whole working from home situation). I'd rather stick with what I have now that is working as I want and don't have to mess around trying to troubleshoot potential problems while at the same time risking internet interruption when internet at home is somewhat crucial ATM

    I don't think I'will wait 1 1/2 years more, just until this Covid situation is over and things get back to - almost - normal.  (Let's all hope it will be sooner that 1 1/2 years). Then I will reconsider migrating.

    Thanks again guys!