Before you get started, you should read this post (and as a rule anything we make 'Sticky' in this forum) all the way through - it contains lots of info and answers to questions you might have around how to participate in one of our popular open beta programs.
As I begin, we'll get some warning-type stuff out of the way first:
*Disclaimer: Public UTM Betas are designed to give you a sneak peek at upcoming technologies. They are unfinished, non-final versions of our product and should NOT be taken as a measure of the fit, finish, capability, and overall quality of the final release. In short, it's not done yet! If you use the beta, you should expect things to go terribly wrong, configurations to crash, space time rifts to form, and machines which suck in hapless administrators and make them fight in "the games". All in all, betas will do things unbecoming a polished, production-ready version. While we don't stop you using these versions in production, we don't recommend it if you cannot afford downtime and the usual quirks of running beta software. You, fair warrior, are on your own. The choice is up to you. (To be clear, you cannot call support for help with Beta Versions, no matter your support level!)
Now for the fun part! We have dozens of new features for you test, and I invite you to play with anything you like and provide feedback by posting your results. Much will change throughout the months of the beta, and we will add even more into the release as developers finish them. Just so nothing was forgotten, some features are listed as "Coming Soon" which means we will add them for sure as soon as they are ready. There are still some other things which we won't announce just yet, but will for sure update this thread with those new features as they are added.
**A word about UTM Endpoint Protection** (UPDATED March 29)
If you currently rely on the use of UTM Endpoint protection in UTM 9, take note: The normal 9.0 clients use a different broker server than the 9.1 Beta Clients. Upon GA we will merge these for flawless continued operation. For now, if you want to use UTM 9.1 and are already using UTM 9.0x with endpoint clients installed, you will need to install them again using the updated links from the UTM 9.1 WebAdmin. If you do not, existing clients will not show up or be able to be managed by UTM 9.1.
How to join the UTM 9.1 Beta
Participating is easy, just look in the download thread elsewhere in this forum for links to the most current version of the beta, download the ISO image for your hardware or software device, and install it. Once on the beta track, you will be able to update along the beta releases without re-installing, including to the final version after the GA release. It is NOT possible to come from a production version to a beta track without installation from scratch, however you can restore a backup file from UTM 9 to get you started.
*License files for use during the beta are posted in the download thread.
What's New in Sophos UTM 9.1
Full documentation, release notes, and updated collateral will not be published before the GA release, however a summary of changes for UTM 9.1 is as below. Things will be introduced as the Beta progresses, check back for updates and new features to try!
Major New Things
- Wireless Repeating and Bridging for AP50
Now you can use the AP50 as an network bridge, allowing for the wireless radio to be used as a link back to another AP50 and then using the Ethernet port to connect a wired device. You can also configure a repeater to allow for extending your wireless coverage to areas where an Ethernet jack is not available (only a power outlet). It is possible to combine both these features as well, by creating repeater bridges that both link back to another AP50 for the control connection and repeat the SSID's on the bridged AP. - Web Protection for UTM Endpoint
You are now able to enforce Web policy in the UTM Endpoint client, offering you the means to control Web surfing on clients running UTM Endpoint when they leave the office and move out from behind the Web Protection security provided by the UTM itself. Clients will be logged separately in a new Web Endpoint log, all reports and logs will end up on the UTM via the Liveconnect service offering a true aggregated view, and UTM Web Endpoint clients on the network will not be double-filtered when surfing behind the UTM in the office. - Support for MAC Addresses
It is now possible to use MAC Addresses for some areas of the security policy. You will find a revamped object-system that unifies some areas which could become confusing and disconnected (like DHCP Static Mappings), and allows for using MAC addresses in firewall rules and for various operations in RED and Wireless as well. - SSL VPN for iOS and Android
Using the newly-released SSL VPN client from OpenVPN (free in both the Android and iOS App Stores) you can connect to your network via SSL tunnel on your mobile. If you have already setup SSL VPN you can just login to the UserPortal and choose the new IOS/Android option under the SSL VPN Section which will trigger a configuration-less profile import (no need to for example use iTunes to sync the package files). Install the client and setup your connection easier than ever! - Offline Provisioning for RED devices
You can now deploy RED across private networks with no public Internet connection or way to connect to the public RED provisioning server. More detail will come soon, but since the existing RED devices need the NEW firmware so they can support loading their configuration from USB stick you need to first register your RED to an online UTM so it can update its firmware and thus know about the new USB loading of configuration. It's a bit of a chicken-egg scenario. There will be a transition period until RED devices begin shipping with the new firmwares from the factory. To use this feature, the "Add Red" section under "advanced" when deploying a RED has a new drop-down where you can select to load the RED configuration via USB (offline provisioning). From there, boot your firmware-updated RED with the file in the root of any USB flash drive and the RED will provision that way to the UTM without any need for Internet connectivity. (Firmware updates now load from the UTM as well, so you can download a new UTM 9.1x+ release, load it manually, update the UTM offline, and it will send new updates and firmwares directly to the connected offline-mode RED devices.
Minor New Things
- NEW! Redirect Capability has been added to Wireless Hotspots. If a redirect is configured, the user will be redirected to the specified website after successfully authenticating.
- Download Throttling ability for QoS - In the past you had to try and control how the upload FROM the internal interface would limit traffic in an effort to control a download. Now we have added a whole new tab to Quality of Service dedicated to controlling downloads. Look for more improvements and design changes to QoS in coming versions. We have many plans for this area.
- Sophos Authentication Agent for Mac is now available to track user activity with precision as is available already for Windows.
- You can now choose to view the firewall rules which have been created automatically from configuration options via a toggle in the firewall rules section.
- Notifiers are available for when a VPN tunnel goes down/comes up again. This includes RED devices. The new notifications can be found in the notifications section.
- Time-events can now be created which span Midnight, making it easy to define "after-work" periods.
- A new WebAdmin role has been created that allows for management of the Mail Quarantine only. (Coming Soon)
- Country blocking has been enhanced to allow for separate incoming and outgoing traffic decisions.
- Country blocking now supports the creation of exceptions.
- SSL VPN Profiles have been added! You can now offer varying levels of access to different user(s).
- RED devices now have a new security option which allows them to be auto de-authorized if they are offline for a configured time.
- RED devices support White/Black lists for MAC addresses on a Per-RED Basis for optional additional security. (Thanks Beetle)
- RED devices now retrieve their firmware updates from the UTM they are connected to (firmware for RED is included with UTM Up2Date packages now).
- Multipath rules can now be made 'sticky', ensuring the traffic is not part of the fail-over behavior and is always routed over the desired connection, even if the link is down.
- UTM will now cache Endpoint Updates for Sophos UTM and Classic clients that are behind the UTM to avoid saturating the Internet connection when an update for Endpoint Protection is available. You can configure this behaviour from the advanced tab with the "Force caching for Sophos Endpoint updates" check box (this requires Web Caching to be enabled)
- Web-Caching is disabled by default on new installations. (Note that this disables Endpoint Update caching abilities, see above).
- IPv6 Support has been further enhanced, and is now available for the POP3 proxy, server load balancing, and more!
- Portscan detection has been extended with IPv6 support
- IPv6 Prefix delegation support
- IPv6 renumbering support
- Our amazing Amazon VPC connector now supports the Amazon single-tunnel IPSec connection option (BGP with dual tunnels still provides additional benefits however).
- DNSSEC validation has been added. Note that you should be careful that your configured DNS forwarders are DNSSEC capable! (Google has announced their servers support this).
- POP3 proxy now supports encrypted SSL connections
- On/Off "traffic lights" have been replaced with a new toggle-switch design.
- SSH Access now has a lockout option like WebAdmin to assist in preventing repeated attempts (see below)
- Block Password guessing has been expanded to include several system areas beyond the previous WebAdmin-only lockout. This feature (and previous WebAdmin security lockout feature) has been updated and moved to "Definitions & Users->Authentication Servers--->Advanced" now.
- Exceptions created for Web Server Protection can now have their state toggled on/off.
- Multi-link PPP support has been added to bundle multiple PPP connections into one logical one (one IP address instead of multiple). Support depends on the provider.
- Support for VDSL VLAN tagging has been added.
- The way the Web proxy handles temporary files has been redesigned to offer a large performance and throughput increase.
- Many improvements and optimizations have been made to the database system to increase overall performance.
- Totally re-designed Block-Page customization system for Web! There is lots to see; even use your own HTML code.
- You can now specify a maximum file download size for Web Proxy users. (This pairs nicely with the option to restrict AV scanning to files no larger than "X")
- Support has been added for many USB Ethernet network adapters.
- You no longer need to enter passwords twice when performing many operations in WebAdmin. Fingers=saved.
- IPSEC Tunnels can now be bound to their local interface using a check box when creating an IPSEC VPN connection. Tunnels can then be used with multipath rules AND fail to other tunnels as needed. Great for if you have an MPLS circuit as well as IPSEC line over the Internet for example).
- Backup Files can be deleted using multi-select check boxes or all at once using a select all option at the bottom of your list of backups.
- Flash has been replaced in charts. They are now using JavaScript magic and work on smartphones while becoming faster and saving you Flash headaches in general.
- Most of our Sophos Services (like Endpoint Updates) have Application Control patterns now.
- Onyxia has had her deep-breath ability altered
- AP10's in some regions should have a much stronger and reliable signal.
- In-line and Executive reports will show host names where available before resorting to display of IP address.
- In-line and Executive reports now show user / definition names instead of IP's throughout
- Throughput figures in many outputs will properly scale their units intelligently based on the data.
- RED10/50 can now take advantage of more 3G/UMTS devices. Some LTE ones may work as well, we are actively working on that.
- When importing the WebAdmin CA into Internet Explorer, jedi-mind trickery has been applied so that IE actually remembers this now.
- New behaviour choices have been added for the handling of unscannable archives in Web Server Protection (Web Server Protection >> Web Application Firewall >> Firewall Profiles)
- You can now choose (AES + GCM) or (AES + CTR) as encryption algorithms in addition to the existing (AES + HMAC) ciphers. (AES + GCM) measurably increases performance on Intel processors.
- UserPortal will no longer display HTML5 VPN section as a choice if the logged-in user isn't configured for any connections.
- The logging daemon has been updated to a multi-core version. Logging & Network-accounting performance on multi-core systems will increase dramatically and use resources much more efficiently, up to a factor of 20x on bigger systems (to use a conservative estimate).
- When configuring HA, the initial database synchronization will be much faster as many performance optimizations have been made.
- WebServer Protection (WAF) can now accommodate Outlook Anywhere traffic. You will find a new button to enable this in Protection Profiles.
- Database in-line calls have been heavily optimized and will yield much faster reporting across many areas.
- Amazon Cloud instances of UTM can now have their initial interface edited (such as to rename them from the default "Internal").
- The Backup creation process text has changed to indicate backups can be made which exclude the license, passwords, and per-site unique data so users know they can easily make re-usable backup files (such as having a good base configuration of common options).
Other information
- For those of you using the UTM 9 along with the UTM 9 Endpoint client, note that we have changed the broker service being used. If your configuration has necessitated the creation of specific firewall rules to the Sophos Live Broker service, you will need to review and update those rules and their destination(s) accordingly to ensure effectiveness once Endpoint Protection is declared fit for use in the UTM 9.1 beta.
- Anti-Virus detection positives (Sophos Engine only) are now reported to Sophos Labs as part of the UTM Feedback Program ("Help make Sophos UTM better?") in order to help ongoing research and protection efforts.
Often, things slip in or simply get forgotten about. If you see something new that wasn't there before, post a reply here and I'll add it AND give you a mention in this famous thread for you to ever be immortalized in type.
-Your friendly neighborhood Product Ninja
