Thread Info
  • State Verified Answer
  • +6 person also asked this people also asked this
  • Locked Locked
  • Replies 165 replies
  • Answers 3 answers
  • Subscribers 55 subscribers
  • Views 525236 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Release of v17 MR-2?

Steppenwolf

Hej,

now that MR-1 has appeared, I wanted to ask when MR-2 will appear? The problems and instabilities of IPSec in v17 (especially in connection with V16.5) are very annoying.



This thread was automatically locked due to age.
Parents
  • 0

    Just a quick update. I've been working with the GES team, but so far no changes. I was able to upgrade to MR3 and they got the tunnel to establish. It ran for almost a week and then started disconnecting every few hours. High availability completely breaks the tunnel.

     

    The thing that still seems to work, even though it shouldn't, is that if I switch the ipsec profile from Main Mode to Aggressive Mode the tunnel becomes more stable and will only disconnect about once a day rather than every few hours. This is strange because the ASA on the other end is set to Main Mode, and the vpn profile is not even supposed to be compatible with Aggressive Mode. It actually makes the selection list on tunnel profile blank. So this appears to be a definite bug. We're discussing switching back to Cisco. This issue has become a deal breaker for us.

     

    Anyone else had any luck?

  • 0 in reply to RyanDonohue

    We're in the same boat.  Not an ASA but connecting to a Cisco Router at HQ.   Disconnects multiple times a day.  In our case the tunnel loses some of it's SA's that get established. Out of 9 SA's  that are part of the tunnel only one or two show green in the vpn connection and the site goes down. A reconnect will re-establish it, but what a pain in the butt. 

     

    If anyone as a rock solid VPN connection to  a cisco device I would love to know what configuration you're using.   

     

    -Scott

     

  • 0 in reply to apalm123

    We are 18 month late on the development.  v16, v17 have mostly been bug creation/fix so far, and minor cosmetic stuff.  We now have CASB, kind of, but I wonder how many XG users use it actually.  Would have been far more important to fix LDAP connection, Reporting, and all others things mentioned already too many times. 

    The REAL problem I see is that major community contributors stopped posting. We see as many questions generated as before, but not many "experts" left to answer them.  SFOS 17.1.1 MR-1 so far is stable for us, but the pace at which development happens was a legitimate argument to look elsewhere.  We are stalled ...

    Paul Jr 

  • 0 in reply to Big_Buck

    Hi folks,

    I think one of the biggest issues is the failure to perform QA completely on each release , just look at the latest UTM issues.

    Don't get me wrong I am not downplaying the missing features. I must admit I have not yet compared v17.1.1 with my home user list of missing or faulty features.

    Ian

  • 0 in reply to Big_Buck

    I agree,

     

    A while back the updates were coming thick and fast and with each brought new bugs and issues. I always find it would be difficult to fully QA every detail every time due to the expansive way we all configure, use and deploy the XG Firewalls (not excusing basic QA)

    I have found many issues and work arounds through other users like you guys and some who no longer visit the forums and I haven't yet found Sophos Support that good at what they do.

    I also need to upgrade my XG Firewall to a bigger one and I am stuck deciding whether to stay Sophos or reinvest in something else without the headaches. I have spend the best part of the last 2 years learning and configuring the current XG and I still find issues daily that frankly shouldn't happen.

    STAS is a steaming pile of dog turd on a good day!

    I truely hope some Sophos folk read this and reiterate to the development team they will lose many customers if the fail to raise the bar a bit.

  • 0 in reply to M8ey

    There are things in the list that could be fixed very rapidly.  For example, NTP time services have been developed on all platforms on the planet a long time ago.  There is no need to re develop that code. It already exist everywhere !!! Same goes for DNS.  Same goes for a lot of things in the list.  I do not know how complicated it is to re code Stass however.  Symantec have  “DC Interface”  since Mathusalem that is very small as a service and works as intended.

    What I do understand is that XG is a collection of services running on an hardened OS that Sophos have not developed.  They integrate and secure services mostly.  The rest is a WEB interface to cover it.  VPN is Strongswan (https://www.strongswan.org/) for example.

    So ....  

    Paul Jr

  • 0 in reply to Big_Buck

    I hear you mate!

     

    The XG was probably released about 2 years too early.

    Seems Sophos lack direction....

  • 0 in reply to M8ey

    Ian: Like your description of STAS :) Have your issues with STAS not yet been resolved?

     

    I suspect many of us are in the same boat. Also need to upgrade hardware at the end of 2018. Stick with Sophos or move to Fortigate.

    I have received good support from Sophos but at the cost of multiple international calls from Cape Town, South Africa to the UK. Sophos have toll free or local numbers for numerous countries but forgot that there is large continent called Africa.

  • 0 in reply to envercpt

    It definitely does feel like the pace of development has slowed considerably.

  • 0 in reply to envercpt

    envercpt said:

    Have your issues with STAS not yet been resolved? 

     

    STAS works well about 98.5% of the time - its the ones where a user logs on and gets the 10.255.0.1 pop up (me) when I am authenticating with AD fine.

    Or when for no reason the XG stops authenticating me and either cuts me off or goes to NTLM - random and no reason why.

     

    Stuff like that gets a little old and when you have a heap of users having to log off and back on to get a connection due to STAS having a cow its not a good thing.

  • 0 in reply to M8ey

    STAS for us has been a bit of a PITA, but primarily for machines that have multiple users logging in during the day.  I have found the SSO client to work well.  It is unfortunate that the installer that Sophos wrote has so many bugs, it is practically uninstallable.  I actually wrote my own installer and pushed via a GPO.  All you need is Advanced Installer 15, the executable, add to the Installer project a registry entry HKLM-software-MS-Windows-CurrentVersion-Run.  Have the GPO itself put in the HKCU the ip of the sophos, and the domain name (the executable does not look at HKLM).  I abandoned STAS recently and am actually quite happy with the SSO client.  A few other issues with STAS:  1) if the db file gets too big on a DC, it can mess up authentication.  2) STAS can cause an loop lock from web traffic on a terminal server.  This issue I did not see until this latest version.  Yes, you can take measure to deal with a terminal server, but if for whatever reason you don't, might take a while to figure out just what is breaking authentication completely.  This I find inexcusable. 

  • 0 in reply to David Carskadon

    SSO Client works fine for the most customer, who can build their script at their own.

    The "Sophos" logon script is only a example but you are right, you can build your own GPO with the correct flags in registry etc.

    Do you want to publish a How to: about this? I am quite sure,  is happy tp help you to update an KBA. 

Reply Children