Sophos XG in Azure Backups Failing

Question

We have Sophos XG as a VM in Microsoft Azure. The firmware version is: SFOS 16.05.4 MR-4 
 Our backups are failing. The error we get is: 
 Backup failed with an internal error. Please retry the operation in a few minutes. If the problem persists, please contact Microsoft Support. 
 After calling MS support, they offered the following two actions to try: 
 
 Update the Linux agent by using these instructions: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/update-agent 
 Allow the firewall to communicate with the following URLs:
 
 www.msftncsi.com 
 *.Microsoft.com 
 *.windowsazure.com 
 *.microsoftonline.com 
 *.windows.net

What does the community think about these actions? Especially installing a new Linux agent since I cannot find instructions on how to do this on Sophos? 
 James

DavidOkeyode · Answer

Hi James, for a network appliance like the Sophos XG firewall, it's best to use the internal backup mechanism of backing up the configuration rather than using Azure backup. The way that agent based backup tools work can cause instabilities to network appliances. Please review this documentation - community.sophos.com/.../123145

Kyle Lambert · Answer

Hey David, Totally understand the other options and what can be done for getting backups. Unfortunately, that's what we have had to do as a work around for this feature missing. I think this issue is more important since this product is supposed to be fully support on the Azure platform (having customer build their own automated work around is not supplying a fully supported product). Looking at the logs I've posted earlier, we see the default gateway being pulled by the Azure Backup extension is incorrect: 2017/12/27 18:50:14.206819 INFO Send dhcp request 2017/12/27 18:50:14.327049 INFO Configure routes 2017/12/27 18:50:14.328563 INFO Gateway:10.3.0.1 2017/12/27 18:50:14.329659 INFO Routes:None 2017/12/27 18:50:14.330629 INFO Request to install route: 0 0 10.3.0.1 2017/12/27 18:50:14.331552 INFO Wire server endpoint:168.63.129.16 2017/12/27 18:50:14.619054 INFO Fabric preferred wire protocol version:2015-04-05 2017/12/27 18:50:14.630500 INFO Wire protocol version:2012-11-30 2017/12/27 18:50:14.631822 WARNING Server prefered version:2015-04-05 2017/12/27 18:50:18.549316 WARNING Socket IOError [Errno 101] Network is unreachable, args:(101, 'Network is unreachable') 2017/12/27 18:50:18.553391 INFO Retry=0, GET 168.63.129.16:80/.../. 2017/12/27 18:50:29.881964 INFO Start env monitor service. 2017/12/27 18:50:29.884259 INFO Configure routes 2017/12/27 18:50:29.886142 INFO Gateway:10.3.0.1 2017/12/27 18:50:29.887008 INFO Routes:None 2017/12/27 18:50:29.902138 INFO Request to install route: 0 0 10.3.0.1 2017/12/27 18:50:29.980362 INFO Event: name=WALA, op=HeartBeat, message= 2017/12/27 18:50:29.992694 INFO Set block dev timeout: sda with timeout: 300 2017/12/27 18:50:29.996017 INFO Handle new ext handler config 2017/12/27 18:50:30.005986 INFO Set block dev timeout: sdb with timeout: 300 2017/12/27 18:50:30.029992 INFO Set block dev timeout: sdc with timeout: 300 Azure Backup on linux or windows requires outbound internet access for the IaaS Azure Backup product to work but the "network unreachable" is what causes this product to fail because of an incorrect default route. I believe the correct solution is to not have customers build a workaround by creating an automated pipeline (ie. jenkins, terraform) but instead Sopho's product should be fully supported and compatible with azure. And for the last year it has not been fully compatible with Azure. I recommend to development team at Sophos Cloud should work with the Azure Backup product team to correct the code to pull the correct IP for the default gateway. It does not appear to be a difficult fix for this type of feature.