Trouble booting from USB to install the latest XG Home Edition SW-19.0.1_MR-1-365

OK so..   It seems that Intel has removed Legacy BIOS support from all chipsets starting Dec 2020.  This is a latest model Celeron J6412, so therefore incompatible with Sophos.

Quite odd that in 2022, when hardware vendors are phasing out, or indeed have removed Legacy support, that Sophos doe snot support UEFI.

Is there a thread of feature request somewhere that UEFI users can request or follow any progress on when this will be implemented?

Over to pfsense I guess.  Sad as I love Sophos and use their hardware appliances on all my customers.  Just can't justify the cost for my home network.

Ken

Check out the server motherboards, they still support legacy boot, or at least my last purchase does. Asus,  Xeon based with intel nics.

ian

Based on the kernel version that the XG uses, these following chipsets should be compatible. I have used a few of these with no issues..

82575/6, 82580, I350, I354, and I210/I211 based gigabit network connections

Intel® PRO/1000 PCI-E (82563/6/7, 82571/2/3/4/7/8/9, or 82583) I217/I218/I219 

Intel® PRO/1000 PCI and PCI-X family of gigabit network connections according to their website. 

https://www.intel.com/content/www/us/en/support/articles/000005480/ethernet-products.html.

Any of those fanless Pcs with i210, i211, i217, i218, i219 should work.

Wonderful, thanks for verifying

Not, the i219.

Ian

Hi,

please check these devices, some have intel i211 NICs,

https://www.amazon.com/pfSense-Firewall/s?k=pfSense+Firewall

If it is just you travelling, then you do not need a high speed chip, the older j1900 might suit. They are slow to configure..

Ian

h, OK , so avoid the i219 chipset.  Thanks

Well, my family and I travel around the globe and we setup our network which has quite a bit of traffic. I'll need a newer chipset, I think the J4125 will be right. 

So on this device, with an i210/211 chipset, I should be able to install Sophos on?

https://www.aliexpress.com/item/1005004740762730.html

Cheers,

Ken

I recommend you to not spend money on those low-end appliances.

It will be much better to buy a N5105 or J6413 with the I226-V NIC and use Proxmox to virtualize Sophos Firewall since the overhead with KVM is minimum to non-existent, and It will allow you to use the 2.5G port to It's fullest.

If you do this, in the future when Sophos starts shipping a installer with UEFI support you will be able to overwrite Proxmox and use the appliance as bare-metal.

rfcat_vk said:

Not, the i219.

Does the XG not support this chipset?

Prism said:

f you do this, in the future when Sophos starts shipping a installer with UEFI support you will be able to overwrite Proxmox and use the appliance as bare-metal.

It's more than just UEFI requirement. The kernel of the firmware has to be updated to a newer version to support the newer NICs without needing to virtualize.  The current kernel included in the Sophos Firewall was released in 2016. That's a really old kernel. 

alan weir said:

The current kernel included in the Sophos Firewall was released in 2016. That's a really old kernel. 

Sophos Firewall v19.5 is currently running: Linux localhost 4.14.277

The 4.14 is a LTS branch, the version the Firewall is running is from April 2022.

If you virtualize with KVM and use VirtiO you won't need to worry about firmware or UEFI support with the Firewall. From this scenario It doesn't make sense to get an older appliance just because the Firewall doesn't have a newer Kernel.

alan weir said:

The current kernel included in the Sophos Firewall was released in 2016. That's a really old kernel. 

Sophos Firewall v19.5 is currently running: Linux localhost 4.14.277

The 4.14 is a LTS branch, the version the Firewall is running is from April 2022.

If you virtualize with KVM and use VirtiO you won't need to worry about firmware or UEFI support with the Firewall. From this scenario It doesn't make sense to get an older appliance just because the Firewall doesn't have a newer Kernel.

Sophos could without much effort change the SFOS to support EUFI boot because the hardware version of XG I believe already supports UEFI boot.

Ian

I would like to remind you we're home users, we don't have a support contract.

Because of this home users have to work with what they got, since using KVM to virtualize the Firewall won't cause a considerable performance drop, It doesn't make sense to get an older appliance when you can just... virtualize It.

rfcat_vk said:

Sophos could without much effort change the SFOS to support EUFI boot because the hardware version of XG I believe already supports UEFI boot.

I've been hearing this for years, since they still don't support UEFI over Software installations It's better to buy something new and virtualize the Firewall instead of waiting for a miracle. (Or maybe they bring support with v20, who knows.)

Thanks to you all for your great advice.  Since I would ideally not want to spend any more money on a device at the moment, I'm going to try Proxmox first.  My current device is more than powerful enough and has 8Gb RAM.

I'll report back once I have tested.

Thanks again!!!

Prism said:

Sophos Firewall v19.5 is currently running: Linux localhost 4.14.277

The 4.14 is a LTS branch, the version the Firewall is running is from April 2022.

My point was that the kernel is not new enough to support the latest Intel NICs. Even if someone used Proxmox, the NIC cannot be passed-through, only virtualized according to others here. Whether it's an LTS kernel or not, it's still "old".

Hey all,

OK, so I managed to get Proxmox up and ruining, which was not nearly as straight forward as it seems.  Lots of issues, but now it is stable.

Installed Sophos XG Home and now testing the speeds etc.

ken Mills said:

OK, so I managed to get Proxmox up and ruining

Do you plan on running any other VM in Proxmox as well? 

No, just the Sophos

Is it working OK? Maybe you can list the steps you took to create the VM in Proxmox in case others want to try it to. 

Hey, no the performance is terrible.  I am only getting like 80/80  on a Gigabit internet connection.  I am testing different NIC configurations but preliminary tests seems to make me want  to not virtualize...

Check IPS settings. In the UTM too many IPS rules can have a severe performance impact. Did you try turning off auto-negotiation and setting manually to gigabit ethernet?