Release of v17 MR-2?

Not sure if it makes a difference in Home licence, but my home xg105w now has more options in general settings in MTA mode....

So its there, but hopefully it works. :-)

EDIT - Just did a quick check with the block list, and it works fine. To block (and probably whitelist) you can enter the individual address, or wildcard "*@domain.com"

Interestingly...I'm only seeing this problem(problem using manually created encryption policy) on one XG135.  I have another one that does not have this issue, but it doesnt have an active VPN going  like I did on the first one.  Going through the creation process on the second unit I can choose a manually created ipsec/encryption policy.    I've opened up a support ticket, hopefully they can give me an answer.

Thank you for taking a look. So it looks like it is only at the admin level.  What a shame that they did not create it to be at the user level via the User Portal like it is in UTM 9.X

There are two tests I'll do tonite.  I will re-install MR2, with Sophos' own guidelines, and check if HTTPS traffic between both sites still kills the VPN.  Few weeks ago, I raised a ticket on this that was later closed unresolved.  Last time HTTPS traffic true the VPN was flowing nice in the Lab, but failed in real life.  Sophos support could not find the source of that problem.  We played with timing and modified some parameters because "main office profile" and "remote office profile" were not the same to start with !!!  But even with that fixed, VPN was unreliable.

I will also recreate a new custom rule with IKEv2.  Well the same I have now finally ...  Just to make sure there's no dead bodies in the closet.  Just for dead-peer-detection alone, IKEv2 is mandatory.

Your opinion is polite and respectful, but I wish to expose a different opinion about what I think is fair here.   I was able to kill MR2 IKEv2 VPN in nano seconds.  With standard parameters except for one.  So expressing frustrations loudly about a failing VPN implementation based on technologies that date back in the 80s for IKEv1, and 2005 for IKEv2 seems fair enough to me.  Particularly when we've been dragging reliability issues for so long.

I'll keep everyone informed about my results tomorrow hoping it helps some ...

Scott_D_L said:

I'm not seeing anything in the MR-2 bug fix list about PPoE connections.  Did this make it in MR-2?  I sure hope it did.

Hi Scott,

the fix is of a more general nature to address the handling of interface events in a better way.

It is not mentioned explicitly in the list.

Great.  Thanks for the info dna.

-Scott

I'm having IPsec Issues here, too.

Cisco VPN with iOS. The log viewer shows the following error:

IKE_SA timed out before it could be established

Reverted back to MR1 for today...

Best Regards

Dom Nik

Hi Scott,

Scott_D_L said:

See my comment above about custom IPSEC policies.  It appears that custom ipsec policies are not showing up as selectable.  If you go to modify that VPN connection you will not be able to select your IKEv2_KeyNegTries_Unlimited Policy I'm betting (it wont be in list)

The policies shown in this dropdown are dependent on several factors. There is already a ticket open to improve the situation, because it is not obvious which policies can be expected in the list. It depends on Gatewaytype (initiator/responder) as well as options in the policy, mainly 'When Peer Unreachable' setting.

You have a sophos support ticket open regarding this issue, may i ask you for the ticket number?

Kind Regards,

Afschin

Thanks Afschin,

Case ID# is Case 7778728  .  I'm on another call at the moment, but feel free to use the access ID I gave in ticket to take a look. (this is system is in production, so please be aware of that )

Thanks for your help!

-Scott

rrosson said:

Rodrigo Pereira

NC-19881 [Mail Proxy] Whitelist and blacklist for e-mail/domains in WebAdmin. 

Are we sure this made it into MR2?

Hi Ron,

according to the internal ticket system it made it into MR2. I'd suggest having a testrun/testsetup to be sure it matches your expectations.

Best Regards,

Afschin