Sophos XG New Firmware: MR2 - some very nice patches

[jamesp]

Version

· SF 17.0 MR2 (17.0.2.116)

News

· Maintenance Release.

Bugs

1. NC-22609 [Access] Unable to import groups inside multiple OUs from AD.

2. NC-19427 [API] Wrong date in validationError.log.

3. NC-22394 [Authentication] User Portal login is logged as SSL VPN login.

4. NC-22769 [Authentication] When importing from AD, the name of OUs which are inherited by multiple OUs and groups is not shown correctly.

5. NC-23112 [Authentication] Authentication Agent - getting logged out automatically at random time.

6. NC-19665 [backup-Restore] Downloading backup creates Java exceptions.

7. NC-21785 [base System] Wizard UI Improvements.

8. NC-22229 [base System] SG115: pressing power off button does not shutdown appliance.

9. NC-22574 [base System] Control center misleadingly shows notification of new firmware availability for few minutes after firmware upgrade.

10.NC-22631 [base System] Typo in fwinstaller.

11.NC-22688 [base System, Certificates] Missing QuoVadis Root Certificate.

12.NC-22771 [base System] Export of 16.5 MR8 and import into v17.0 GA fails for configs without hostname.

13.NC-22780 [base System] Migration from CR to SF failed on CR500ia-10F appliance.

14.NC-22911 [base System] Blank screen is displayed when user synchronizes license after successful registration.

15.NC-25573 [base System] Users cannot activate license keys from SFOS.

16.NC-22354 [Certificates] Passphrase box disappears after trying to upload a CA with private-key after upload fails.

17.NC-22734 [Clientless Access] HTML5 VPN: keyboard input not working on Android devices.

18.NC-22751 [Documentation] Japanese translation for LogViewer missing.

19.NC-17413 [Firewall] Business rules created with device destined IP address can't be blocked with network rules.

20.NC-20602 [Firewall] Incorrect validation for local acl and zone where HTTPS is disabled from current login zone.

21.NC-21180 [Firewall] Add "Action" column to firewall rule grouping.

22.NC-21897 [Firewall] Import/Export of firewall rule with dependent entity fails when a VLAN is configured on WAN.

23.NC-22219 [Firewall] Issue with SNAT policy with multiple gateways.

24.NC-22557 [Firewall] Service edit option not working in specific case.

25.NC-22670 [Firewall] Unable to create RED interface.

26.NC-22923 [Firewall] Hostset ERROR: XG stopped Responding.

27.NC-22932 [Firewall] Export/Import fails for every entity after exporting Security Policy entity.

28.NC-22946 [Firewall] Typo in SF API documentation for IP host object.

29.NC-22958 [Firewall, SFM-SCFM] SFM Compatibility v17: DNAT rule cannot be updated in some combinations of forward type.

30.NC-22982 [Firewall] Incorrect position of firewall rule name in Firefox.

31.NC-22424 [Framework(UI)] Close notification button does not work properly.

32.NC-22917 [Framework(UI)] Information icon does not show any info text in authentication page.

33.NC-21856 [iPS] In AppFilter policy smart filter values are still displayed after removal.

34.NC-22448 [iPS] Custom IPS signature not working for all keyword supported by snort.

35.NC-22753 [iPS] Application filter is not updated when there is no application matching smart filter.

36.NC-22834 [iPS] Application Filter Policy: All application is showing while editing through firewall rule with "selected individual application".

37.NC-22382 [iPsec] IPsec UI allow to configure incompatible policy resulting in a silent DPD action change in the backend.

38.NC-22383 [iPsec] Typo in IPsec policy list: 'Action on Active Peer'.

39.NC-22489 [iPsec] Incorrect IP routes added for local VPN traffic in case of NAT over IPsec.

40.NC-22502 [iPsec] IPsec PSK secrets files do not contain local VPN IP.

41.NC-22620 [iPsec] DGD can not be disabled.

42.NC-22622 [iPsec] 'Remote ID' value shows blank on UI for IPSEC connection when external cert is used.

43.NC-22633 [iPsec] Activate on save tries to connect to respond only connections.

44.NC-22793 [iPsec] Cisco VPN connection with cert auth not working on iOS using config from userportal.

45.NC-22888 [iPsec] IPsec S2S tunnel with PSK and local/remote ids not working.

46.NC-22892 [iPsec] Aggressive mode IPsec policys are not filtered correctly in UI.

47.NC-22900 [iPsec] Cannot create 2 IPsec RSA connections with same local id to different remote gateways.

48.NC-22914 [iPsec] Connection status for DGD IPsec connections is not shown correctly.

49.NC-23035 [iPsec] DGD table locked - postgres has returned errcode 25P02.

50.NC-23125 [iPsec] "Randomize Re-Keying Margin by" - When setting the value to 0%, UI displays 100% after saving the policy.

51.NC-23186 [iPsec] IPsec status not displayed when too many SAs are established.

52.NC-22549 [Logging] Sandstorm logo displayed in RED for reason "eligible","pending" & "Cloud Malicious".

53.NC-22745 [Logging] Port and protocol information are missing in LogViewer standard view and filter.

54.NC-15612 [Mail Proxy] Update DLP engine and CCL data.

55.NC-19881 [Mail Proxy] Whitelist and blacklist for e-mail/domains in WebAdmin.

56.NC-21366 [Mail Proxy] Spam e-mails pass due to error " X-CTCH-Error: Unable to connect local ctasd".

57.NC-21437 [Mail Proxy] Mail addresses with "systems" or "solutions" as top level domain cannot be added in address groups.

58.NC-21671 [Mail Proxy] Message is not displayed properly in LogViewer.

59.NC-21891 [Mail Proxy] Spam headers displayed in e-mail when sent through reply portal.

60.NC-22271 [Mail Proxy] Issues with mails in spool marked with a firewall ID.

61.NC-22921 [Mail Proxy] Email flow is affected for recipients using TLS1.0.

62.NC-25332 [Mail Proxy] awarrenmta service segfaults when IP reputation is enabled.

63.NC-22504 [Network Services] Unable to assign two static IP mappings for the same host in different DHCP scopes.

64.NC-22163 [Networking] OSPF Neighbors not updated on changing multicast group limit.

65.NC-22539 [Networking] Fail to add vlan when specific DHCP server confiration migrated.

66.NC-22662 [Networking] Unable to make changes in WAN Link Manager for an interface with /31 subnet .

67.NC-21952 [RED] Site-to-Site RED tunnel between XG and UTM does not pass traffic with hardware acceleration enabled.

68.NC-22433 [RED] Generating certificates fails when long company name is used.

69.NC-22174 [Reporting] Missing size verification on custom logo for on-box reporting.

70.NC-22819 [Reporting] Application reports stop working after enabling Sync App Control.

71.NC-22853 [Reporting] Drill down is not working in mail report when "Mail Count" is selected as sortby.

72.NC-22868 [Reporting] Font style mismatch.

73.NC-22364 [securityHeartbeat] EP_Certificates table not available error .

74.NC-22778 [securityHeartbeat] Heartbeat registration fails with appliance in HA.

75.NC-22151 [sSLVPN] When using special character in Appliance Certificate, SSL VPN connection fails.

76.NC-22116 [synchronized App Control] Last occurance time of applications in SAC is not consistent between HA nodes.

77.NC-22384 [synchronized App Control] After de-registration of Heartbeat enhancedappctrl service is still running.

78.NC-22440 [synchronized App Control] Sort list of categories in SAC customize menu.

79.NC-22766 [synchronized App Control] Path of a customized app is shortened in SAC customize popup when app path contains slashes.

80.NC-22768 [synchronized App Control] Uncategorized category is shown twice in the SAC customize popup.

81.NC-22813 [synchronized App Control] Fixed height for SAC data table.

82.NC-22824 [synchronized App Control] EP name with special character is not displayed correctly for macOS in SAC list.

83.NC-22962 [synchronized App Control] Show category in SAC app list.

84.NC-22544 [uI] Incorrect start time displayed in Live Users list.

85.NC-22576 [uI] Disclaimer message is shown without line breaks.

86.NC-25275 [uI] Internet usage time displayed "NaN:NaN" value in Live Users list.

87.NC-22319 [WAF] "Edit Reverse Authentication" dialog contains untranslatable strings.

88.NC-22521 [WAF] Leftover of shm files cause a WAF restart loop.

89.NC-21534 [Web] Certificate error on accessing sites with https scanning enabled.

90.NC-21930 [Web] Incorrect Error message on Captive Portal when the user exceeds the number of simultaneous logins.

91.NC-22023 [Web] Word list files with non-UTF8 or whitespace-only should not be uploaded successfully.

92.NC-22124 [Web] Web Policy rule is converted to "AllWebTraffic" when adding more than one backslash character in the rule.

93.NC-22125 [Web] When maximum limit is reached, web exceptions cannot be updated anymore.

94.NC-22403 [Web] Certificate Error while accessing Outlook with direct proxy.

95.NC-22653 [Web] Policy Tester does not display backslash in policy name correctly.

96.NC-22721 [Web] AVD dies unpredictably when it runs out of memory.

97.NC-22800 [Web] AVD stability fixes.

98.NC-22930 [Web] Server side rbuf not reset for reused request.

99.NC-22954 [Web] Access to Custom Captive Portal does not work.

100. NC-23156 [Web] Not able to access any websites due to malformed ATP data update.

101. NC-23163 [Web] Font color for Initial Setup Wizard changes.

102. NC-12089 [Wireless] Unable to edit alias of "GuestAP" interface.

103. NC-19166 [Wireless] SSID disappears randomly with Dynamic Channel Selection.

104. NC-20761 [Wireless] Wireless Client List shows wrong IP address after network change.

105. NC-21369 [Wireless] VLAN and non VLAN SSIDs can't be selected at the same time for RED15w.

106. NC-22358 [Wireless] SSID is not broadcasted from time to time.

107. NC-22852 [Wireless] Wireless network interface status states being unplugged.

 

Some great fixes - I'm patching a load of XG's now - will report any oddities there after

[jamesp]

Three XG's thus far updated, no issues.

Some of my slight VPN S2S issues are gone, looks good to go to people!