[8.980][BUG] Using Availability Groups in ACC (SUM) Server Config

I've been experimenting with setting up a high availability option for UTM connections back to a central ACC / SUM system... and have noticed that, for some reason, one cannot use an Availability Group in the Central Management configuration for the ACC host. This would be nice to have, if someone has more than one ISP setup at the ACC end (and didn't happen to have the funds to provision more expensive BGP implementations). Should be fairly simple to fix... See my screenshot showing where I think an Availability Group option should be, well, available. [:)]

Also... don't know the timeline, but maybe the Central Management terminology should be updated to reflect the move to the Sophos UTM Manager platform as opposed to ACC.

0 Astaro Beta Bot over 12 years ago

Thanks for reporting. We are now tracking this as Mantis ID #21893
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Astaro Beta Bot over 12 years ago

The Mantis ID #21893 is now under investigation. We are planning to release a fix for this issue in Version 9.009.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 12 years ago

Hi Bruce,

I'm tracking the renaming of ACC with that Mantis ID. Regarding the Availability Group topic, I've talked to one of the developers. Seems like it's only a small code change, but they want to run a few tests and learn about the possible consequences before they (maybe( implement this feature. One of their concerns is that they don't have a way to prevent a misconfiguration: you could configure it in a way that the UTM connects to multiple ACCs, which would probably lead to "very funny" behavior.

Cheers,
Kai
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 12 years ago in reply to kbr

As an MSP, this functionality would be much appreciated. I understand the risk regarding the possibility of misconfiguration, but I think this should be an option. Thanks for looking at this!

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Astaro Beta Bot over 12 years ago

The Mantis ID #21893 is now being worked on.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Astaro Beta Bot over 12 years ago

The Mantis ID #21893 is now being worked on. We are planning to release a fix for this issue in Version 9.001.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 12 years ago in reply to kbr

Hi Bruce,

I'm tracking the renaming of ACC with that Mantis ID. Regarding the Availability Group topic, I've talked to one of the developers. Seems like it's only a small code change, but they want to run a few tests and learn about the possible consequences before they (maybe( implement this feature. One of their concerns is that they don't have a way to prevent a misconfiguration: you could configure it in a way that the UTM connects to multiple ACCs, which would probably lead to "very funny" behavior.

Cheers,
Kai

Kai, an idea occurs -- maybe add checking in the code so that if one uses an Availability Group in that field, force them to use a shared secret --- that would go a long way in preventing the connection to multiple disparate ACCs, as most ACC deployments would use unique shared secrets -- not a perfect solution, I know, but it would help if it's that big of a concern.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 12 years ago

Hey Bruce,

I just discussed this with the developer: we both don't like this approach, because it feels a little bit too magic, needs extensive documentation and doesn't really save us from misconfiguration, as you still can put two different ACCs with the same shared secret in there. We'd prefer to simply say "If you use availability groups here, make sure that every entry directs to the same ACC". That's clear, straight forward and easy to understand (ie. "No Magic UI behavior involved").

As I said earlier: in general, they like the idea. They just want to test it to make sure that it really does what you expect it to do...

Cheers,
Kai
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 12 years ago in reply to kbr

Sounds good, thank you!

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Astaro Beta Bot over 12 years ago

The Mantis ID #21893 is now being worked on. We are planning to release a fix for this issue in Version 9.009.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel