XG / XGS ongoing issues list

Hi,

with the wan issue, just edit it without making changes then save it, usually cause the updated address.

ian

Let me rephrase this: 

1. This should be fixed by now, based on the PPPoE Protocol. There are certainly some scenarios, which could still lead to this problem (if the ISP is doing something odd). 

2. You can simply save the interface without change - This will reload the interface and essentially doing the same like "Turn off/on" on UTM. 

3. Mail relay is a question, what they do. SMTP Auth is not implemented on SFOS. This means: you cannot do a smtp auth against the firewall. You could do a host based relay. SFOS uses Exim like UTM does. BTW: SMTP Auth is a poor design decision IMO - You do not have a summarized Email summary / logs. I would always recommend to send all Emails first to the Email server. 

That is good news the PPPoE user interfaces now have a automatic renew on link failure, but what about the non PPPoE users who have a standard DHCP addressing function from their ISP/RSPs that is still broken. Using link manager to indicate a link has failed only sends notifications does not cause the address renew request to be sent.

Ian

Hi rfcat_vkDHCP client (XG) will not send new IP requests until its lease time is over. Making the modem ON/OFF or plugging/unplugging the physical link will not trigger any renewal events. This is how the DHCP client works in SFOS as per DHCP RFC. On interface update event we forcefully restart the DHCP client which will generate the request again.

Thank you for the explanation, but that does not work in real life. The time to live is an artificial XG parameter, the time to live used by the ISP/RSP is way shorter eg if you disconnect and reconnect a short time eg less than a minute you will usually be assigned a new IP address. So maybe it is time for Sophos to move away from the theoretical document to a real world process and reduce the stress on your customers?

Ian

This is sort of what I'm getting at. These are professional high end devices aimed to compete with CISCO and and the likes. Being able to release and renew an IP address is simple stuff, and clicking save without changing anything and hoping it does what you say is a workaround at best, and an unwillingness to build in a feature that is a staple for Interfaces. This is what I hear back all the time. Makes me think... what else will I find, with more workarounds if I migrate to XGS. I'm not at all interested in taking a system that works perfect, and then getting to test and learn workarounds for flaws that should have been addressed years ago.

So for 1)... that seems like a disclaimer. My Dlink router at home as no issues with the ISP Changing ip addresses. So, I'm not very confident with this reply.

2) This is a workaround... I would like a way to release\renew WITH confirmation that this was done. This is a basic function that all routers should have. 

TP-Link can do it. 

3) So for this one, I'm reading that it's not going to work (or work well), plus it's not how you'd recommend it done, so you suggest doing something else. Another... workaround suggestion, to a feature that works on SG, but not on SFOS(XGS). 

XGS constantly seems like a downgrade. Shouldn't these devices let administrators run their network the way they want? Where is the flexibility? Seems like SOPHOS is going the way of Apple. "We'll tell you the way you want it and you'll like it our way".

Are we talking about PPPoE or not? Because it depends on this answer at this point.

PPPoE is something, which has a reconnect option. There is a renewal process in place etc. 

If you get a standard Ethernet connection, this is something else. 

About SMTP Auth. Sure you can do what ever you want in your network, but maybe sometimes it is time to consider to rebuild some installations. SMTP is a product, which is current under review to be migrated solely to microsoft. Most customers i am talking to are going to M365 as a mail provider. So no need to do this firewall email relaying anymore. 

Sophos is investing in the next generation email security technologies like Central Email. 

I'd need to find out from the ISP how they do DHCP renewals. Suffice to say... no issues with SG, constant issues with XG...

Would you agree to this?  "If it worked for SG, it'll work for XGS"

So I hear what you are saying... "SMTP Auth is not implemented on SFOS". So this means no... SOPHOS has removed this feature?

So... a workaround for IP renewal, No to SMTP, WAN IPs might possibly renew if dynamic, and this is all because SOPHOS is investing in the future. I'm sure this is all for my own good too.

And the biggest question of all for me is.... "What else will I find out AFTER i've migrated our 14 firewalls over". Since the response of the things I know of are nope, maybe, and not an issue... Not compelling.

UTM is a old product. It has now 20 years development. So in this timeframe there are certainly features which are on UTM and not implemented in SFOS. But on the other side, you will find plenty features, which never made to UTM. So you are currently focusing on "missing features" and not on the security advantages you will get by migrating. Certainly you cannot say "if its worked on UTM, it will work on SFOS" - Simply because the focus moved to Security first. Protecting the customer is more important than getting a SMTP workaround for a implementation like that. Using a UTM as a Mail MTA relay for your entire company sounds like a mistake to me. 

If you experiencing a problem with the ISP renewal, you can contact Support to get this clarified. I am not aware of a issue based on the current version. 

SMTP Auth - Feel free to reach out to your Sales Rep to get this addressed. But in the long run, maybe you are on your way for M365 as well.