Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 84 replies
  • Subscribers 48 subscribers
  • Views 579471 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG Firewall 16.05 RC1

talex

Hi XG Community!

We've finished SFOS v16.05.0 RC1 and want to hand it to you as a soft-release.

Those of you who already used Sophos UTM might remember that we do soft-releases from time to time. For all others, let me quickly explain what it is:

Soft-Release:

We finish the release and think it's worth getting some feedback before shipping the release to all.

So we provide the links to the update packages to you via this forum and you can download the update package and upload it to your SFOS device.

We will monitor the feedback in this forum for some time and then ship the release to everyone.

For detailed list of features and changes , Please refer the attached Release Note : 6523.Sophos XG Firewall v16_5 RN_v3.3.pdf

 

Issues Resolved

NC-12759 [Authentication] Segmentation Fault of access server
NC-13930 [Authentication] Access_server segmentation fault
NC-14100 [Authentication] Appliance IP doesn't appear on general tab of STAS suite
NC-14160 [Authentication] Netbios packages sent out via WAN port
NC-13972 [Base System] Webadmin certificate is not updated when changing common name in ca certificate
NC-14123 [Base System] No reconnect of ipsec tunnel when using IPv6
NC-14140 [Base System] If VPN profile name is matching an existing log file then the profile will log to this log file
NC-14227 [Certificates] Improve error message for Certificate Revocation List
NC-3820 [Certificates] The validation period To/From is not taken into account for CRL uploads
NC-13394 [Clientless Access(HTTP/HTTPS)] Japanese character issue in HTTP bookmark of clientless access
NC-13014 [FirewallDatapath] Not able to ping local machine located in DMZ zone from LAN zone with IPsec S2S tunnel setup
NC-13665 [Firewall] Skipping load balancing for missing heartbeat drop traffic
NC-13702 [Firewall] Block Page with captive portal link shown for users when webfilter + user based rules are used
NC-13987 [Firewall] Wizard failed after configure DOS rule using src-zone
NC-14137 [Firewall] 'Internet Scheme' page loading failed
NC-11810 [Framework(UI)] Application List headings are removed after applying filter
NC-13043 [Framework(UI)] Control Center - system graph initially renders without title
NC-13858 [Framework(UI)] Improve XG Firewall dashboard diagrams
NC-14649 [Framework(UI)] Possible SQL injection in EventViewerHelper
NC-14671 [Framework(UI)] XSS in LiveConnectionDetail.jsp in SFOS
NC-15101 [Framework(UI)] Apache service stop in case of certificate names contain space characters
NC-8116 [Framework(UI)] Disable TLS1.0 and TLS1.1 support for Webadmin and Userportal
NC-14995 [Galileo Heartbeat] Heartbeat - Service restarting automatically
NC-14244 [Hotspot] Hotspot type POTD send extra mail while updating password creation time
NC-13610 [IDS + AppControl] Psiphon Proxy application is not blocked
NC-13496 [IPS] Wrong ip address shown in web filter logviewer when device configured in TAP-Mode
NC-14231 [IPS] Internet traffic dropped by IPS if network subscription is missing
NC-12228 [Mail Proxy] MIME whitelist box is not large enough to display the entire text
NC-14093 [Mail Proxy] Proxy stops processing mails if IP reputation is enabled with action "Reject"
NC-14098 [Mail Proxy] Delivery failure notification not sent if sender or recipient email address contains space character
NC-14178 [Mail Proxy] SMTP proxy dies to due to specific characters in return path of delivery failure notification
NC-14213 [Mail Proxy] Read only profile should be set in Email protection in HA mode
NC-13448 [Network Services] DHCP service dies while binding custom option to DHCP Server
NC-12214 [Networking] New warning message for unbinding interfaces trivialize effects
NC-12966 [Networking] WWAN connectivity issue with Huawei E3372
NC-13449 [Networking] DHCP Option is deleted without removing it's binding.
NC-13599 [RED] Transparent Split and 3G Failover should not be possible to configure
NC-14164 [RED] [RED] implement "TLS 1.2 only" mode
NC-11769 [Reporting] Event Type 'Not Available' seen in Reports of Admin Events
NC-12472 [Reporting] PDF Report Export/On Demand: When records continue on 2nd page server time change
NC-13257 [Reporting] Pagination is not working for "Interface" widget in executive report.
NC-14337 [Reporting] Reports is not loading when language is spanish
NC-6345 [Reporting] Custom Reports: Sometimes application/protocoll filter is not working properly
NC-12969 [SSLVPN] SSLVPN Remote-Access to Apple iPhone: traffic cannot pass through tunnel
NC-13945 [UI] Log Viewer link from widget window is not working
NC-13995 [VPN] VPN failover group stops retrying after couple of minutes
NC-6589 [VPN] DHCP_V6A_IPSec connection not re-connected when changing IPv4 address of the same WAN interface
NC-14118 [WAF] SFM MR-2 can not push web server configuration to SFv16 device
NC-11111 [Web] Captive Portal settings: unauthenticated users redirection does not work
NC-10629 [Wireless] Wifiauth service dies
NC-13207 [Wireless] hostapd dies state after updating radius server in wireless global settings
NC-13326 [Wireless] High CPU usage of DHCPd
NC-13340 [Wireless] Update organizationally unique identifier (OUI) library
NC-13940 [Wireless] Red15w wireless is not detected
NC-14000 [Wireless] DHCP option 234 code missing in "editreddevice" opcode
NC-9469 [Wireless] WLAN interfaces are not shown in network configuration wizard if wireless network name contains 'WLAN'

Known Issues

There is an issue with the Sandstorm licensing if you try to initiate the 30 day evaluation via ControlCenter.
After you clicked the 30 days trial button, you will be redirected to the MySophos portal where you finish the subscription process. At the end you will see a HTTP 404 error page, because the redirect URL is not correct.
As a workaround, please redo the steps until you get to the license overview of your device. The license should be synced to your device at that time.
This issue does not appear if you initiate the process via MySophos instead via ControlCenter

Downloads

You can find the firmware for your appliance from in MySophos portal.

 

happy testing
/talex



This thread was automatically locked due to age.
Parents
  • 0

    My XG developed a strange application categorization problem this morning. I have rebooted it twice but the problem persists, I even tried moving the firmware back to 16.01.2 as a last ditch effort but the app categorization has died. I have a few application QoS rules that are very important for internet sanity specially with all the guests and family visiting at this time of the year. I will revert back to 16.01.2 and apply a recent backup and will pickup on the RC next year. Sorry guys for not being able to troubleshoot any further, but without layer7, it feels like ancient times[:D] 

Reply
  • 0

    My XG developed a strange application categorization problem this morning. I have rebooted it twice but the problem persists, I even tried moving the firmware back to 16.01.2 as a last ditch effort but the app categorization has died. I have a few application QoS rules that are very important for internet sanity specially with all the guests and family visiting at this time of the year. I will revert back to 16.01.2 and apply a recent backup and will pickup on the RC next year. Sorry guys for not being able to troubleshoot any further, but without layer7, it feels like ancient times[:D] 

Children
  • 0 in reply to Billybob

    Dang, I didn't notice that until you said something.  I've upgraded 2 appliances so far and just checked both and see the same thing.  I didn't notice cause i don't really have any layer 7 rules on those appliances, but glad you pointed that out cause I was going to upgrade a bunch of customers over the holiday break, but better hang tight till that is resolved.  At least your getting a few things categorized, unlike this one.

     

    Thanks

     

  • 0 in reply to Billybob

    I am seeing a smaller quantity of what you have reported, but most of the stuff is classified.

    Things like the DNS as being unclassfied will just add more junk reports to the IPS logs which continually show my internal devices as initiating DNS attacks.

    Merry Christmas to to you Billybob and thank you for reporting.

    Probably means someone changed the classification database without testing it. So, in theory rollingback should also fail with same issue?

  • 0 in reply to Billybob

    Hi all.

    Only today I had the time to apply 16.05 RC1.

    As Bill and other people wrote, web categorization is not categorizing correctly the URLs.

    Waiting for an official reply and the next RC.

    Thanks

  • 0 in reply to lferrara

    @ Ian, I forgot about the classification database errors. You maybe on to something. I am running

    IPS and Application signatures
    3.13.16

    I tried to revert back to the GA release but it was much easier to change my traffic back to UTM9 vm. I have been so spoiled with UTM9 backup/restore process that I tried doing the same with XG. What a pain, I can't believe that a restore that takes virtually a few seconds in UTM9 takes so long in XG. I won't be doing anymore restores anytime soon[:#]

    @luk (terminator) thanks for testing RC1, hopefully it is just a database issue. Lets give sophos guys a break for the holidays[:)] Have fun cooking for christmas (Here is instructor zero... awesome italian special forces shooter doing some italian cooking. https://www.youtube.com/watch?v=U4OEtEmlvyQ . Check out some of his other tactical videos[:O])

    Thank you everyone for testing and thank you sophos for taking non stop abuse from us. We love you all. Merry Christmas and happy holidays!!!

    Regards
    Bill

  • 0 in reply to Billybob

    Bill,

    a Terminator never stops! Even if there are some bugs I would like to say "well done" to Sophos Team because they released a RC here in order to be able to test it and report bug.

    We need to get back soon from Sophos Staff and see JIRA numbers with their fixing date (still missing on many JIRA, an improvement that must be included and shared into 2017).

    Sophos sells because we sell and because we believe in them. Without us, they will lose Market position and many of them will lose the job. Also Sophos and other security company wil work during these holidays because bad guys never stop and also they take advantage of this situation.

    Logging part is another feature that we will see soon (v17) and hope to see other feature too.

    The Category classification is a bug and also the categorization is not working as UTM9 where the Web Filter engine used was another one. XG now uses Cyberoam Engine (that must be improved). I never liked Cyberoam Web Engine (many false positive/negative compared to UTM9).

    Hope also to see more investigation and more feedback here from Sophos Staff. , , , did a great improvement during this year but Sophos XG needs some other steps in order to be sellable (in my opinion) and more interventation and faster support is required. 

    During the Christmas time I am busy with cooking but an eye on Community will be there too.

    I hope all of you have seen the new feature available with v16.5. Now we can see object proprieties inside Firewall rules without clicking on editing. See the attachments.

    Well done to Sophos develops!

    Happy Christmas to you all. In some way, we are a family too.

  • 0 in reply to lferrara

    More hidden stuff...

    After a reboot in older versions this screen was presented if you tried to login too fast

    With 16.05 we get 

    Lets hope we are not rebooting for any reason[:D]

  • 0 in reply to lferrara

    One think I forgot to write:

    I do not like that inside the Avdanced Threat there are also the Sandstorm Activity. Logs and reports must be in one location and not scattered. They have the big limitation of having too many TABs with few menu.

    Another big improvement we expect to see into v17.

    Regards

  • 0 in reply to lferrara

    Hi guys,

    there is another thread where one of the Sophos staff advise to stop and restart the web service because it does not appear to be connecting to the wingc server and also run a command to capture some details from a log file.

    Made no difference in my case.

  • 0 in reply to rfcat_vk

    An update:

    Today an IPS update has been released: 3.13.17, but the web filter still did not work, so I reboot the XG and now categorization is working.

    Update the pattern and notify if the Web Filter is working again.

    Thanks

  • 0 in reply to lferrara

    Mine started working by issuing the service WINGc:restart -ds nosync command. I am assuming everyone was affected by this and only a few people complained? Nobody is using XG or everyone is using it at home and happy they got everything protected while their 9 year old is watching porn because categorization was broken for 2 days. Another interesting aspect of the whole problem is that I had category NONE blocked in webfiltering. But when the filter breaks, NONE is allowed as the categorization system is broken.

    There is also a BUG in XG probably was there from v16, but I just noticed it. Restarting your appliance CHECKS AND INSTALLS PATTERN UPDATES even when the updates are set to DO NOT AUTO UPDATE

    Strange, I have to protect my XG by using another firewall so that the XG wouldn't protect me from myself[;)]