Release of v17 MR-2?

Also not the case for me either. With 17mr3 I had these ikev1 issues but I have a stable 175 Mbps down and 30 Mbps up on my end, and the other end has at least that maybe more. During troubleshooting I was  Running a continuous ping with my laptop hooked directly to the modem for 2 days, no packet loss. I also had my ISP run a ping from their end. No packet loss 48 hours, but tunnel went down at least 50 times.

Afschin,

I've PM'ed you the details.  Also one thing I've omitted is that on the cisco side we are running in trasport mode rather than tunnel .

Thanks,

-Scott

So now here's the new big question in my mind, and I'm sure the minds of everyone stuck with this issue. With Sophos' announcement of a patch for the Spectre/Meltdown vulnerability, will the maintenance release that contains that patch either require MR3 to be running, or be a rollup that contains MR3? Because right now I'm thinking that it's going to come down to us being between the rock and the hard place of patching a critical hole or breaking a critical vpn that our company depends on. If the upcoming patch is going to break that I am going to need to go ahead and schedule a flight out to our datacenter to roll back to 16.5. So if any Sophos employees have any insight into this it would be extremely helpful.

Again, I would strongly recommend that Sophos apply some resources to creating a smooth downgrade path back to 16.5 since their affected customers are now in a very dangerous predicament. I may be the only one who feels this way, but this issue has made me want to throw all of my Sophos UTM's out the window, and depending on how Sophos continues to handle this issue I am becoming very unlikely to continue running Sophos in our environment when our renewals come back up. 

Matt Webb said:

I can't reiterate Ryan's point here enough. Many of us have been working with firewalls and vpn concentrators for a long time. I can't remember the last time I was uncomfortable heading out of town because of such a device and whether it would require hands-on support.

Personally, after moving to MR3 and completely rebuilding my IKEv2 tunnel to Azure with a new IPSEC profile I've had good results. The pre-built Azure ipsec profile that came with one of these MR's doesn't work at all - doesn't even reflect the requirements M$ themselves have published.

I'm not touching mine until it seems stable enough to be ready to try redundant tunnels - at this point seems like it would just drag me into another week of pain.

 

I completely agree with this assessment of the way Sophos support deals with issues. They lay the responsibility on the user for their terrible products.  I have been, and continue to be, in the same situation where logs are requested and sent but no suggested action or resolution ever comes in return.  Logs are requested several times even though they have been provided.  I've even been told they cannot help me with out logs...for a case where the device was not able to be accessed!  Also, I've never experienced a tech support policy of providing logs as a requirement for a case to be escalated.  In most cases based on my 20 years of network experience, escalation is based on priority, how many users are affected, etc...but Sophos says they won't escalated cases without logs...weird.

At best, on some issues I have been given temporary workarounds that are indicated by tech support to be resolved issues.  THERE IS A HUGE DIFFERENCE BETWEEN A WORKAROUND AND SOLUTION.  At least to most IT professionals this is the case, but not so with Sophos Tech Support.

The vast majority of my issues with my XG unit go unresolved and I just move on as best as I can. 

HI all,

And finally i've got the WHY.....

Sophos has migrated the ipsec engine to https://strongswan.org/ which is free.

There is no hazard, and that why every of us was asking by support to completely recreate the ipsec profiles. We know that after recreating everything it's not stable too.

Today i upgrade a v15.1 to v16.5.8 and ipsec vpn are still... perfectly STABLE !!! (without recreating anything)

I need V17 NOW (dns wildcard objects, IKEV2, object group for firewall) and i won't/can't recreate anything on my configurations.

PLEASE SOPHOS just give us a functionnal release !!!!!!

Yes they moved from openswan in v16 to strongswan in 17. The frustration we're all experiencing does not center around the ipsec engine but rather in whatever transitional code was required to bring existing connections and profiles from openswan to strongswan. I won't pretend to know what is involved exactly but I would assume that when looking at a firmware upgrade you would want something that translates your current config into whatever the new firmware is built on.

If you (Sophos) can't create such transitional code, at least let us know as part of the upgrade process we'll need to reconfigure some of our settings (e.g. completely delete and reconfigure ipsec profiles and connections).

That was not the case for me Matt. This was a new install. I was not running 16 at any point on this UTM. I have also recreated the tunnel many times with support, and continue to have the issue. 

Is StronSwan that bad ?  I would like to hear.

On paper, I would say it is sexy.  At least I like this part:

• Storage of RSA private keys and certificates on a smartcard (PKCS #11 interface) or protected by a TPM 2.0

Now is there a TPM in a XG210 ? I will have to check.

What I realize over time, is Sophos uses open source at many places.  For example, AP55C runs OpenWRT. https://openwrt.org/

Paul Jr

I don't think it's good or bad... it have been so badly implemented !!!

Many of us here tried to run IPSEC vpn between sophos in fresh v17 and it doesn't work !

haw can it be possible to don't release 4 version without ANY improvements of a problem, so simple to reproduce ????