Does Sophos XG Support AUTH SMTP relay in MTA mode?

SFOS does not support SMTP Auth. It was never implemented and i am still arguing this to be a "problem" in the implementation to this day. 

From my point of view, there should be a a central instance (email server) storing all emails and be send from there. Using a SMTP Auth vs a gateway product (SMTP MTA) could potentially open plenty of issues. 

Reality seems to match what you're saying generally. It does seem to be implemented, at least at the GUI level, since there's a pretty little check box and a place to add allowed users for authentication, but no one can seem to figure out how to actually implement it. 

What is the use case of SMTP auth? What do you plan to integrate and how do you mitigate SMTP threats? 

In this case, it's Syncro. We use it as an RMM. It was emailing fine through the UTM, but after switching to XG, it fails. 

With the Sophos in MTA mode, my understanding is that it handles the transactions, then relays back to my Exch. 

That pretty much puts it in front of the Exch server. 

We also lock down relaying in XG and Exchange. 

This is the Syncro interface I'm using, which is very limited. 

The current error is "AUTH command used when not advertised" when attempting Auth SMTP relay. 

I don't want to switch to transparent mode, since that makes the firewall useless in terms of Email protection. 

Where is this solution based? Is it a cloud application or on-premise? Or to rephrase it: Do you have a IP/FQDN, which this vendor is using for sending a Email? 

If so - You could relay it directly to the Exchange. The Exchange will accept the email and then forward it to the needed places. 

They are a web-based SAAS provider. IP Relay is the sole solution I can see as well.

Still waiting on Syncro to clarify their sending IP/IP range. 

Its just dumb that this isn't supported. FFS, UTM managed it fine, but Sophos "upgraded" and broke something quite useful. 

Combine that with the horrific on-hold 18-sec loop and Im starting to hate this company more every day.

On the other side. take a look at Central, Reporting, XDR and the capabilities for IT Security, it will increase your actual goal: Having a secure environment.

BTW: IP Relay means essentially, your SAAS Provider talks to the Exchange and on the Exchange, you can configure a SMTP Gateway for this service.

BTW2: Most customers move to O365, and as O365 simply supports this as a Mail gateway, this seems to be the better approach. So if you actually move to Exchange online in the future, you can disable this entire Email feature on SFOS/UTM anyway. 

We use CYNET for endpoint sec. I used Sophos AV in the past and wasn't impressed, at all. CYNET is a stellar product, albeit more expensive. 

I'm well aware of what IP relay is for SMTP. 

We're not likely migrating to O365 anytime soon. On-Prem exch has worked fine until this Sophos XG garbage. 

Did you upgrade your Exchange already? Yesterday another Critical CVE for Exchange: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321 

Yeah. I stay up on patches. We were CU 22 when it was released and this sec patch was installed the day after release. 

I'll just end this thread here. 

Sophos UTM supported this function without issue. Sophos decided to pretend to support it in XG, but doesn't really support it and so far, the best solution from Sophos is to convert to O365, bypassing the Firewall MTA. lol

I appreciate your time nonetheless. 

O365 does not bypass the Firewall MTA. It simply does not need it. In O365, you are working with the MTA of Microsoft. 

BTW: Did you investigate about breaches? This CVE is already known to be used in the wild. There is a script from Microsoft to check for breaches. 

O365 does not bypass the Firewall MTA, because it doesn't use it. Well, yeah. 

You know what the word "bypass" means, right?

I'm well aware of Exch vulns and we're patched. 

O365 does not bypass the Firewall MTA, because it doesn't use it. Well, yeah. 

You know what the word "bypass" means, right?

I'm well aware of Exch vulns and we're patched. 

BTW: Office365 can be protected on another level of technology. 

See: Integrations of Central Email into O365. The next generation of integrations is about APIs. Central integrates with O365 on a API level, not a MTA Level.
Then you are able to utilize things like "Post delivery protection". Which basically means, if we detect a attack after SMTP, we can simply remove the Email from the mailbox of the client after delivery. A thing a UTM/SFOS never can do.

Central Email is a next generation solution for Email anyway.

Do you make a commission from O365?

Sweet Jesus. You just don't stop with the O365 garbage. 

No i do not. But i see the advantages of Azure AD and O365. 

Do you get commission to stay on Exchange on Premise? 

I do not make commissions by staying on Exch, but at the same time, I'm not telling everyone to switch to on-prem, because the firewall they purchased has a half-assed SMTP relay implementation. 

See the difference?

So you actively do not push a security solution, instead you using network solution?