Sophos XG

[localzuk]

Has anyone moved to Sophos XG from SG?

 

How are you finding it? Our renewal is next year, so I'm looking at maybe making the switch when it comes around.

 

I am slightly uneasy about it for a couple of reasons though:

 

1. Lots of people saying it simply isn't a good experience yet

2. No proper migration tool - so I'd have to rebuild all my rules again.

 

Anyone got any thoughts on it?

[adamsund]

We’re moving early in January so I’ll let you know! I’ve said I want to start from scratch for the majority but any websites we’ve unblocked using tagging can be easily transferred over apparently. As for the rest, I’ll be finding out soon!

[synaesthesia]

We've got an XG in place but not a move from UTM/SG. Very happy with it, as has been documented a few times reporting isn't quite there but it's use is generally intuitive for someone that knows their way around an typical filtering/firewall system. I'd not say it isn't a good experience at all; it's not easy, but these days with the intricacies of HTTPS we're never going to get back to the "good old days" of RM's old filtering setups. It works, it's quick, it ticks all the boxes for us and hasn't batted an eyelid short of a couple of teething issues (firmware related, resolved quickly by joint efforts of our ISP @Wave9 and Sophos) with 1300 users and 600+ devices. Much preferable to Smoothwall from experience.

[Paid_Peanuts]

Pair of XG 550 appliances here, moved from Smoothwall.

 

No issues at all, once you get over the differences between the products we haven't found anything it cannot do.

Application control is great and works well - even without requiring SSL certificates on BYOD devices.

Web filtering is on par with Smoothwall I would say from our experience.

 

Firewall is on another level from Smoothwall.

 

V17.5 brings some nice functionality too like Chromebook integration/support.

 

All in all I am happy with XG - it's proving itself to be rather good.

 

It was my understanding Sophos is winding up the SG/UTM development and concentrating their efforts on XG?

Edited December 13, 2018 by Paid_Peanuts

[HereIGoAgain2601]

We have a mix of SG and XG at the moment across our sites. All the SGs will be replaced in the next 12 months.

I have to say I prefer the interface on the old SG, but think this is because I am more used to how it all works.

There are some nice new features and integration with the Sophos Central we are looking forward to using. Plus looking forward to moving away from a standard proxy to transparent at the same time - that has made our life much easier.

We do struggle sometimes with XG doing the simple things we can do in 2 mins on an SG, but again I think this comes down to familiarity.

Once we have used it a bit more I'm sure it will be fine. Functionality wise things seem to work better than SG so far, no issues during the migration other than trying to figure out how to turn on/off YouTube restricted mode!

[Wave9_Lee]

Hi

 

there are differences between the two, and much of the development will be going into XG in future - although the SG is not mothballed at this point. There are a range of new features on the next firmware update that should be of interest to the Education community, so definitely worth a look.

 

You could extend your SG subscription by a year or two if needed, but we're switching/upgrading SG>XG every week with no issues. Yes, there's a the familiarity aspect, which is the case with any change, but most users are happy after a short period. The migration of rules is a bit manual currently, and where we provide the Sophos, we do this for the customer. If you would like a chat with someone technical at our end about the process, let me know.

[Jaan]

We went from UTM 9 to XG..... we made that jump too soon i feel..... XG wasn't ready for our scenario and maintenance after maintenance release bought one fix and two problems..... we very nearly didn't renew this time.

 

We used Sophos for a long time and we could see it was making (slow) progress....it works well when it works... Things stared to get better the last two MR releases

 

17.5 GA has just been released which addresses alot of our issues.

 

https://community.sophos.com/products/xg-firewall/b/xg-blog/posts/xg-firewall-v17-5-is-coming-soon?pi353792392=672&pi353792397=2

[supportman]

Much nicer interface than smoothwall thats for sure.

 

[Cthulhu]

We upgraded to SophosXG earlier this year and really wish we hadn't. Don't get me wrong, it's a great product on paper, however it just feels like a beta product and not ready for production.

 

It was first setup as a VM machine, this was a big mistake as it kept crashing despite having more resources allocated than what was recommended. During this time, we were being audited and the auditor said that he's heard of this happening for other places. In the end we managed to blag one of their physical appliances for free, the sales guy was kind enough to upgrade it to XG 550, despite it being overkill for our environment.

 

There was a bug with the malware scanner where it kept blocking anything coming through the filter. We had to disable it to get internet access again, this was happening for over a month before it was fixed.

 

When it was first installed, we had issues with authenticating on our Wifi. Granted this was fixed when we were given a beta firmware to test and has been fine on all recent public updates.

 

Enforcing Safesearch was broken for a long time and has only been fixed in a recent update.

 

Keyword and content scanning appears to be an issue for the XG, once the list starts getting over 50 or so words, it starts to struggle a bit and has a noticeable effect on internet browsing with pages sometimes failing to load. The built-in reporting for keywords is useless and requires an external syslog/reporting server to get any useful information out of it.

 

The support from Sophos is and always has been sub-par. We were promised at the time of our contract renewal that their customer support had been overhauled and was now much improved, however from our experience this has not been the case ever since the handover from their after-care support. It can take weeks to get a response from them and in some cases, we haven't even got a reply. There was also a situation where our network had been compromised due to a vulnerability in the XG unit, I called their support line and the person just sent me links to articles on how to block websites.

 

There's then little complaints such as there not being an option to configure scheduled updates and restarts, something that to me is an essential, basic feature and has been available on the UTM ever since we had it. Looking at the feature request forum, it looks like users have been asking for this for years and there's still no sign of it coming to the XG, I'm not getting my hopes up that it will be implemented by the time our contract is up.

 

I have to say though, the Firewall and Web Filter integration works great and coming from the UTM, I love the live log viewer and how easy it makes diagnosing issues.

Edited December 18, 2018 by Cthulhu

[ass17]

I just wish they would bridge the UTM and XG with a migration tool, I bloody hate starting from fresh when you have so much to configure [emoji1]

[abrigham]

I just wish they would bridge the UTM and XG with a migration tool, I bloody hate starting from fresh when you have so much to configure [emoji1]

 

There is an official migration tool available to platinum Sophos partners, let me know if you want the details of the company we use.

[ass17]

There is an official migration tool available to platinum Sophos partners, let me know if you want the details of the company we use.

 

Yes please and I will pass them on the boss man[emoji1303]

[Wave9_Lee]

The Sophos migration tool isn't really fit for purpose, we (and Sophos) recommend a build from scratch, copying policies/rules you want to retain - also presents a good opportunity to review old rules to see if they're still relevant and safe.