XG Firewall v18 MR-5: Feedback and experiences

I have been doing some testing on my home edition, so I cannot log a ticket, but this update has broken HA (Active-Passive);

to clarify my setup & testing performed so far.

I have a VMWare v6.7 with XG running on MR5 (previously I had this running without issue on MR4, it is only when I upgraded to MR5 did I get this issue).

to connect to FTTC, I have a router/modem set to bridge mode (PPPoE PassThru)

Initially I upgraded to MR5, and found that the upgrade on on of the unit did not initiate and update/reboot to the MR5 (a little disappointed).

then to update to MR5,

• I disabled HA
• booted using MR5 on Primary.
• then booted the secondary unit to MR5
• checked config was correct for both units, and tried to configure HA (Active-Passive) using the quick mode - this would not connect.
• then tried interactive mode - this worked - I thought it was just an oversight on my part.
• problem is that I had no internet connection

I checked my network connections and all was correct except for the internet connection.

I assumed that it was the router/modem causing the issue, I then went about getting another router  updated and configured, testing before hand to check that it did indeed connect to the internet via FTTC, I go this setup, abut still no connection.

I now turned to the XG HA setup, disabled HA and voila within seconds, it all connected and i could access the internet.

I can replicate this every time, without issue.

I have even gone through creating new VMs and this same experience happens so it is not down to a configuration issue on my VMs.

if anyone can help me fix the issue I would be very grateful, or if you need to use my system to gather the logs to identify the issue I would also be willing to help.

I hope this provides some info.

Do you use the option to use the physical MACs on HA (Checkbox)?

I did try both options and neither worked, I got the same results.

Likely this is a Switch issue, caused by the virtual MACs loaded by XG. The change to physical MACs should resolve this issue, as i can reproduce this on my vmware without this option. Can you check for Logs in this? And can you check the logs to WAN as well? Because this checkbox needs to be set by interactive mode and both appliances will continue to use their physical MACs. 

Which VMware hypervisor is this? See: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-942BD3AA-731B-4A05-8196-66F2B4BF1ACB.html

Likely this is a Switch issue, caused by the virtual MACs loaded by XG. The change to physical MACs should resolve this issue, as i can reproduce this on my vmware without this option. Can you check for Logs in this? And can you check the logs to WAN as well? Because this checkbox needs to be set by interactive mode and both appliances will continue to use their physical MACs. 

Which VMware hypervisor is this? See: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-942BD3AA-731B-4A05-8196-66F2B4BF1ACB.html

LuCar Toni thanks for that, so it seems that this must be turned on or enabled on initial configuration, as enabling this after config does not help with HA in a virtual environment.

-question, not sure if you are able to answer answer this ..

when an update is applied why does it not offer an option to upgrade both units?

I have read that if it is downloaded automatically it will perform the upgrade in a staged manner, why is this not available for manual uploads? 

This issue seems not to be related to the MR5. XG HAs always upgrade the aux and then the primary. See: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/haStartupHelp/concepts/HAFirmwareUpgrade.html