I have been using Astaro since v2 (1Q02). So I have been through a few upgrades.
I only have one firewall, but it has LOTS of interfaces as this is a research lab with lots of researhy networks. I do not stress my firewall much, and do not use many of the features. I currently have 5 physical interfaces with 10 vlan'd attached networks.
The upgrade was from v6.313 to v7.1 (from the CD I picked up at RSA conference a few months back). I put together a new system, did the install completely isolated (with one notebook connected to the admin interface), then tried to upload and install my current 6.313 backup.
Ooops. Missed that I had to convert the 6.313 backup to the v7 format, and it is clearly tabbed on upload panel .
2 major items did not make it through the conversion: HTTP proxy with local authentication and IPsec passthrough.
Getting the HTTP proxy working was simple, just enable, drag in the networks that use it (the ones with real users on them!), and drag in the allowed users.
The IPsec passthrough was more of a problem. I had a rule that used a group called IPsec that contained ESP and ISAKMP. This got converted to a rule with just ISAKMP. In Services, I found TWO groups called IPsec, the converted one and one new one. I deleted the converted one (as it did not contain AH or ESP NAT traversal) and fixed the rule, then things worked.
In fact there are LOTS of services with the same name, a converted one and a new one. And not all are groups or services that I added. For example there were 2 DNS services.
One difference between SOME of the rules ws the converted ones started with a source port # 0f 1024 and the new ones with a port # of 1. ????? Is this some new broken feature of some OS that uses a source port below 1024?
I like the new GUI, much better than v6 which was a step down from v5 (or was it v4 and I skipped v5? That was a while back, or did I skip v4 going from 3 to 5? [:)] ). I still miss having multiple screens open, say to services and filters.
The new activity screens make it easier to see what is actually happening across my firewall, and I will probably turn on IPS shortly.
I am still upset on the lack of IPv6 support, but then this is an across-the-board issue with firewall vendors with NIST and ICSAlabs pushing to get this done soon now.
This thread was automatically locked due to age.