Future of v17 and v18

Hey tom greene 

Make sure to keep an eye out on our Release Notes & News and Sub-groups for new updates and upcoming betas for future releases.

I'll also tag AlanT and talex in case they wanted to chime in with any further information.

Regards,

FloSupport | Sophos Community Engineer

Bump

It took forever to upgrade on my XG home setup, but did eventually complete and come back up on its own.  I'd say it took between 10-15 minutes which is very unusual, but it does seem to be working ok so far. 

Hi Bill,

I was thinking about this after I restarted and posted my result that I might not have waited long enough.

Tank you for the explanation.

Ian

If you read the error message the backup issue appears to be something very specific to your configuration.

Do you have auto update and install enabled on your pattern configuration?

Ian

Big_Buck said:

2017 and 2018 were dedicated to bug fixes and stability almost exclusively.  Seems to me the real improvement this year was the MTA.

 

Apart from the bits they've now broken. DKIM message body hashes for example - workaround is to bypass outbound scanning of internal mail servers that perform DKIM signing.

I did not know DKIM was busted on Sophos.

But that said for $900 a year, I have the much much more powerful and flawless Symantec Brigthmail MTA appliance.  With every functions you can imagine.

If you toast a single day debugging Sophos Mail Gateway, or Sophos MTA, you already blew up that amount of money.  It is pointless to persist with mail on any Sophos products.  Unless you have more than 500 Users I would say.

Paul Jr

Well the MTA in XG 17.5 doesn't do DKIM, but it's modifying messages beyond just whitespace changes such that the message body hashes are broken.

This is probably why others are also seeing MIME message headers in their mail clients - the MTA is modifying the messages sufficiently that the mail client is no longer capable of displaying them as intended.

Will be looking at options this year for better mail filtering and IPv6 support - the current and expected feature set just isn't there.

What I wished was a single yearly renewal.  But whatever I wish, there is no such thing as a UTM.  Because there is no such thing as unified thread management.  Soon or later, a component on the suite fails to bring the minimum.  That is true with Sophos, Sonic Wall, or whatever else.

So, since I am stuck with two renewals, I will also move to Symantec EndPoint Protection.  Flawless set it and forget it solution.  One reason I moved away from it was the disappearance of their Enterprise suite.  But I hear it is back.  Sophos SEC requires the same maintenance as anything else from Sophos. Chronophagus.

Not set for the firewall yet, but very basic features I require are not even on the radar.  I cannot live without a full DHCP or NTP anymore.  I hate to maintain a VM per subnet (DMZ, Production, et.c.) just for those roles.  And I cannot live without a workable log.

As for IPv6, I won't even try to implement this on XG since it REALLY means maintaining TWO firewalls.  As you now, rules, objects, and everything in IPv4 are totally separated with IPv6.

I do not save times with Sophos.  Everything is much longer and much harder to the Symantec/Checkpoint combination I had before.

By the way, the published set of new features for the next XG 17.5.x, probably in April 2019 since it is schedule in March 2019, is "better centralized Backups" ...

Other than that, I see nothing of any interest this year mentioned anywhere.

Paul Jr

Have you tried the SG product line (aka UTM)? Its much better than XG (IMHO).  I recently switched a customer from SG to XG and let me tell you, its been a painful transition.  (The reason for the switch was the integration between Intercept X and the XG firewall.)

Your right about DHCP and NTP, and don't forget about trying to make sense of the log files, either from the GUI or the command line...  My biggest complaint about XG is the logging.
That and the damn CSS (or whatever) that limits the width of the "viewing portal" on the web pages...
One last thing, SG supports getting certificates from Let's Encrypt automatically.  That means no more forgetting to renew and upload/install/waste 10s of minutes on a certificate.  I'm not sure what is worse, trying to remember what to do with certificate(s) and private key(s) after 1 or more years, or having to do it every 90 days or less...
Almost forgot about the ability to search the interface that SG has...  
I will to get off my soapbox now.

But, Symantec, seriously?  I honestly think your better off with Windows Defender.  I mean, lets face it, who has a more vested interest in protecting Windows than Microsoft?
To be honest, Sophos AV is the only 3rd party AV product I feel comfortable recommending anymore.  I only sell Sophos products because I understand what it is that they are trying to do and I believe that they are doing it well, (OK, XG has a long way to go...) and they are doing things that no one else is doing (at least I'm not aware of any other company doing it...)

Maybe your unaware of Symantec's  follies somewhat recently?

https://www.zdnet.com/article/symantec-antivirus-product-bugs-as-bad-as-they-get/
From above link: "...they were using code derived from open source libraries like libmspack and unrarsrc, but hadn't updated them in at least seven years."
Meaning that the exploit was available for at least 7 years before 2016.  True it was a while ago, but seriously?  How about them as a Certificate Authority?

They used Symantec enterprise endpoint security in a prior job I was at and it was the worst software I've ever encountered.  

They used Symantec enterprise endpoint security in a prior job I was at and it was the worst software I've ever encountered.