Sophos Firewall: v18.5 MR2: Feedback and experiences

Hi folks,

I have installed this version on my xg115W and it is not working well. I have tried a number of different configurations. The aim was to replace my home XG with this new box. I built a configuration based  on my existing system but with many cleaned up and refined policies and firewall rules. That was a disaster, throughput for speediest max'ed out the line, but web surfing, just did not work at all well, pages took many seconds and sometimes minutes to load and more often timed out leaving online payments in limbo.

A restart partially fixed the issue but not completely.

The logviewer showed many failed to associate connection errors.

I removed over 50% of the configuration and in a lot of cases used the default XG provided policies with my firewall rules. With one user connected works well, while not as quick with page loads as my existing XG, still worked.

I moved my IoT network across again after refining and reducing the configuration and end up with poor connection times and lots of cannot associate errors in the logviewer.

So, the conclusion I have come to is that this version of XG software is not suitable for my XG115w with a full business licence.

My IoT network has 7 wifi devices and 5 fixed devices, which most are not always active or powered on.

Ian

Same here with a XG115w, in reality I just wished the WebUI has a "little" bit faster. (I can make a coffee with the time It takes to create and apply a new WAF Rule.)

What are we discussing here. Connection delay or Webadmin responsibility? 

We are talking about device performance both to users and the gui performance.

ian

LuCar Toni said:

Connection delay or Webadmin responsibility? 

Both, but the most noticeable is the WebUI.

Just navigating over It will use 100% of a single core constantly. (Without changing any settings or rules.)

As an example, the XG115w took 1 minute and 27 seconds to create a new WAF Rule; On my old box with a 3300x It would take around ~6 seconds.

Of course, the Ryzen 3300x is around ~7 times faster, but even then, this should not be the reason on why It is so slow to change an Apache config file and restart the service.

Is the firewall doing anything under the hood to take so much time to do (apparently) simple tasks?

If you're doing nothing but watching the Diagnostics > System Graphs, what kind of utilizations are you seeing? Have you tried doing a `top` to see what the top processes are? It sounds like the web server is slow, but I'm wondering if other processes are kicking in. I've noticed at various times `snort` will decide it wants to do a lot that I think isn't directly related to traffic. Or after an upgrade it seems to be a little busy for some period of time.

(On my XGS87, it does about 15% with various spikes, with a fairly small network.)

To be fair, a WAF Rule reload / creation is more than a apache reload. There is modsecurity, other systems like IPS involved and have to be reconfigure. So a WAF Rule in Firewall tab is one of the more slower task of the webadmin and the XG115 is not the most powerful appliance to begin with. As you state by yourself, you compare a slower CPU, dealing with much more tasks with a next generation CPU like Ryzen. 

(Not that many customers use WAF on a XG115 to begin with). 

So back to the topic: Is there a significant difference of the webadmin between MR1 and MR2? Because i could not observe any. 

No,

the GUI performance is an ongoing issue, not between mr1 and mr2 just general performance. It is slow, very slow when working on the XG115W just doing basic things like creating DHCP static addresses, changing a firewall rule, updating policies. Managing the XG115W using CM is no better.

An XG115W is so underpowered, that is you have a couple of users trying to access the internet at the same time the process drops connections because it appear to loose connections details so you end up with multiple retries. I have reviewed the lgviewer on my XG115W and noted the high number of failed to associate issues even the connections to the GUI which makes it even slower.

Ian

No,

the GUI performance is an ongoing issue, not between mr1 and mr2 just general performance. It is slow, very slow when working on the XG115W just doing basic things like creating DHCP static addresses, changing a firewall rule, updating policies. Managing the XG115W using CM is no better.

An XG115W is so underpowered, that is you have a couple of users trying to access the internet at the same time the process drops connections because it appear to loose connections details so you end up with multiple retries. I have reviewed the lgviewer on my XG115W and noted the high number of failed to associate issues even the connections to the GUI which makes it even slower.

Ian

Hi folks,

further testing with my XG115W. One user and it is unusable.

Unable to access CLI, black screen never connects.

Many error in logviewer about failed associations.

The screenshot is after a reboot again with one user..

Ian

Especially SSH should be there, as it is a light weight service. There is something wrong with your appliance. Maybe the disk broken? What kind of XG115 is this? 

It is a brand new XG115W rev 3.

Ian

Did you upgrade or reimage the appliance by arrival? 

Automatic upgrade, no choice.

Ian

I will re-image it today and report back.

Ian