XG 125 - can't update second firmware to SFOS 19.5.0 GA-Build197

Are you trying to upload a file that you downloaded manually before?

Yes, exactly. I was able to upgrade the first firmware without any problems, but I can't upgrade the second one.

Give me the exact filename of the second download, please. There are different versions of the FW for XG and XGS-Systems.

Platform: Hardware / Model: XG125 / Version: SFOS 19.5.0 / File: GA-Build197 HW-19.5.0_GA.SF300-197.sig
(Note: Firmwares displayed via my account and serial number -> Searched by serial number.)

.. SF300 .. is the correct version for an XG model.

Just tried it myself and I get:

SYSTEM messageid="17512" log_type="Event" log_component="Appliance" log_subtype="System" status="" user="" src_ip="" additional_information="" message="Firmware installation failed."

I would have thought, that this is possible. Hmmm.

I think the behaviour here is sluggish:

I am at 19.5.0 GA-Build197 on our XG210 (active firmware image)

I just replaced the inactive firmware version 19.0.1 MR-1-Build365 with 19.0.1 MR-1-Build 350 via the "UPLOAD" button.

After uploading and successfully verifying the uploaded firmware file, I was asked to boot that file with factory defaults (???).

I did NOT say "Upload & Boot" , so why is this question coming up?

After pressing the "cancel" button, the action is stopped and I still have the former second/inactive firmware version 19.0.1 MR-1-Build 365.

Expected behaviour would be to have the option to prepare a quick downgrade to a former firmware version of your choice.

So there seems to be no way to replace an older secondare/inactive firmare image without further booting into it.

To me, that's a very poor design, if this is by intention. At least I don't understand the design.

I just tried to prepare a possible downgrade to 18.5.5 MR-5-Build509, the upload succeded, firmware was verified, thes I was asked again to boot with factory defaults.

So what is the difference between the buttons "Upload" and "Upload & boot" ?

That's exactly how you described it. I thought that I could update both to the same firmware level (as I know from switches, for example). Then this is / would be really a - let's say it positively - limited / modest design.

I think to myself that this is a design flaw. This should / must be corrected in my opinion. There are several errors together (also that with the reset to factory default).

I agree, this is a design flaw.

With switches or with ESXi host we always have a secand bootbank to revert to with a downgrade release of our choice.

Otherwise you would have to do step upgrades just to be sure that the unused firmware is at the version you would like to go back to.

This is unusual complicated.

I agree, this is a design flaw.

With switches or with ESXi host we always have a secand bootbank to revert to with a downgrade release of our choice.

Otherwise you would have to do step upgrades just to be sure that the unused firmware is at the version you would like to go back to.

This is unusual complicated.

And very error prone, which really needs to be corrected. Therefore I will open a support case....

Very good idea!

Started a support portal registration and still waiting for confirmation so I can open the case. As soon as I have / get more information, I will inform here further...

@jprusch: Sorry, only now saw that I posted my problem in the wrong discussion group (Sophos Switch). Can you move my question to the correct discussion group "Sophos Firewall"?

Hi Francesco Marciello ,

Good day and hope all is well. 

I just moved the post on the Sophos Firewall Forum. Will check on this concern and share feedback and updates once I have details on my end. Also, you mentioned that you are opening a ticket, kindly share it to me via DM or by replying to this thread if you already have the ticket number, And please enable support access on your SF and kindly share to me via DM the access ID. so we can look further into it. Thank you

Many thanks for your time and patience and Thank you for choosing Sophos.

Cheers,

Hi Raphael,

Good day, too.

At the moment I'm still struggling with the Support Portal registration
just for information:

As soon as everything is in hand, I'll get back to you.

Ciao Francesco,

they need the serialnumber of your device for almost everything. :-)