Shutting XG down until v17 available

Hi All,

I am using XG at home and on some small customers (XG 135) and it is working quite good. It depends on the feature you need. Email protection is still poor and troubleshooting is challenging.

Loggin is still a nightmare, IPS sometimes goes to 100% and sometimes you have to disable microapp-discovery.

HTTPS scan and Web Engine are working much better on UTM9. It uses another engine and the there is a big difference. For example, on UTM9, ADS are always blocked. On XG, even with HTTPS Scan enabled, on youtube, ADS are still displayed. XG needs a lot of improvements otherwise moving UTM9 users to XG will be difficult....rather the risk is that UTM9 users move to another vendor!

Some basic features are still missing but configuring policies in one place is much better. I really hope to see a big improvement in stability on v17 for IPS, WAF.

Country blocking is not working by design from WAN to LAN. So I agree with you but I have seen a big change from v15 to v16 so I expect to see another big improvement on v17.

Let's see and wait...

Hi Luk, I generally liked XG after using it for a while. It is really not that bad if you don't compare it to UTM9 but I just can't get past certain quirks of XG. As you have mentioned, a lot of people are having trouble with IPS module in current version. I generally disable IPS on my home firewalls as a personal choice. However on XG, layer 7 categorization is tied with IPS. So if you disable IPS from services, your application control rules and application based QoS rules stop working because IPS is disabled. Using a resource heavy snort IPS module instead of netfliter to even classify traffic for dashboard reports is just plain crazy.

I generally found that webfiltering even with ATP enabled in XG seems snappier compared to UTM9, however the categories are a mess and don't always block stuff like ads that UTM9 blocks without a problem. Also, the exceptions are much granular and flexible in UTM9, so in the end UTM9 still wins.

I never really tried MTA after the beta because it didn't have a few things that I really needed in my environment. To be honest, I only use country blocking for help with incoming SMTP spam. Since MTA is not really upto par in XG, I didn't have the need to block incoming traffic but the fact still remains that country blocking doesn't work.

They have been promising better logging since v15. Lets see if v17 can have real logs that don't disappear after a reboot. Other little things that Michael Dunn has revealed that nobody really ever explained clearly such as: 

• DNS traffic being intercepted by https module in XG 
• Microapp detection allowing regular https connections without firewall rules

just drive me crazy[:$]

Web filtering on utm rocks. It is using another engine and the difference is clear. Other vendors are using ips to block applications, so Sophos is going on this direction with XG, why? Utm even on application is working much better.

Logging astaro wins with no even chance for XG.

Mta is not complete on XG.

Let's see if XG v17 improves all the current instability otherwise in Sophos they have to go back on some features and think seriously to listen to us and to use some of the engines used by UTM9.

On enterprise installation, utm still wins with no doubts!

HI All, 

Its true that Sophos drive is towards XG instead of UTM and Cyberoam . We do expect major changes in the next version as well. 

Unfortunately that's the truth. They are even using prices to force XG into customers as its way cheaper than UTM OS even though the hardware of the box is the same; as a partner we are having nightmares over this.

One other thing I miss hardly is the "astaro.org" forums; you could find pretty in depth discussions there which magically 'vanished' when Sophos merged it with this one.

A dream would be that Sophos sells UTM rights to another company so we can have the masterpiece solution Astaro developed back in play. If you thing about it, its a pretty old architecture which still prevails over most of what we have today; if only we still had a full team/company on it.

A funny thing when you look at the marketing is: Sophos is the only company that competes with itself maintaining 2 NGFW security solutions with the exact same objective. This only is enough to represent how superior UTM is in regards to XG.

Unfortunately that's the truth. They are even using prices to force XG into customers as its way cheaper than UTM OS even though the hardware of the box is the same; as a partner we are having nightmares over this.

One other thing I miss hardly is the "astaro.org" forums; you could find pretty in depth discussions there which magically 'vanished' when Sophos merged it with this one.

A dream would be that Sophos sells UTM rights to another company so we can have the masterpiece solution Astaro developed back in play. If you thing about it, its a pretty old architecture which still prevails over most of what we have today; if only we still had a full team/company on it.

A funny thing when you look at the marketing is: Sophos is the only company that competes with itself maintaining 2 NGFW security solutions with the exact same objective. This only is enough to represent how superior UTM is in regards to XG.

I have been crying about sophos competing with itself since v16 beta. Gartner report in 2015 said the same thing

■ Gartner believes that Sophos' dual-line UTM products and expected rationalization may be confusing to existing customers looking for a product upgrade in the next 12 months.

■ Except for the reporting solutions, there has not been any significant integration between the two product lines since the acquisition of Cyberoam. Gartner believes that managing two UTM product lines is a significant burden for the vendor and channel sales, presales and support teams.

The original plan when sophos acquired cyberoam was to kill UTM9 in a couple of years but now they realize that its a cash cow that is still better than XG so they keep on milking it without any significant updates. Lets see what v17 brings.

Feels like staring at the Firing Squad waiting for the call, doesn't it?