Sophos Firewall in education

[Genesis123]

We are currently looking into replacing our on-prem Smoothwall box and like the look of Sophos' Firewall.

 

It would be great to know what you love about Sophos Firewall and what bugs you.

 

I would be interested in knowing how you have configured Sophos Firewall and see if it is similar to the Smoothwall way of doing things when it comes to web filtering.

 

Knowing what you know now would you still switch to Sophos Firewall over something like Smoothwall?

 

Any information you might be able to share on Sophos Firewall and your experiences using it would be really useful.

[Wave9_Lee]

We are currently looking into replacing our on-prem Smoothwall box and like the look of Sophos' Firewall.

 

It would be great to know what you love about Sophos Firewall and what bugs you.

 

I would be interested in knowing how you have configured Sophos Firewall and see if it is similar to the Smoothwall way of doing things when it comes to web filtering.

 

Knowing what you know now would you still switch to Sophos Firewall over something like Smoothwall?

 

Any information you might be able to share on Sophos Firewall and your experiences using it would be really useful.

 

Hi - I know you're looking for community user stories and advice, but if/when you need some advice and info/references etc from a non-salesy provider - I'd be happy to help. Drop me a PM or click the meeting link anytime. Good Luck.

 

Lee

[michael2k6]

Currently sat looking at a bricked Sophos appliance. Experience to date sounds terrible but I'm new in post and so will give it a chance.

Short version of this...

Old version of firmware had an issue which caused the firewalls to go into failsafe and throttle traffic to the point of not being usable.

New firmware version fixes that but breaks wildcards in rules.

New firmware version fixes that but on loading it to the other partition, a couple of running services become stopped. Console stops working and web config becomes incredibly slow to respond. Firewall continues to pass traffic though so left it alone until this morning.

Reboot into new partition, failed boot. Console connects but will only read, cannot send any commands. Including factory reset. At this point we're at the stage of using the factory reset button on the appliance but need connectivity so the old Meraki is coming out of the cupboard to buy us time.

 

That's a snippet of experience to date. As I say though I'm new in post and the amount of problems I can see in tickets is wild... I'm actually wondering if there was a dodgy batch of memory or something that's gone into all of the appliances we have (17 of them purchased at the same time), because this can't be peoples day to day experience.

[Jaan]

We have had a Sophos firewall in some shape or form for i think almost 10 years here. Starting with the "UTM" devices to our current "XG" it's been a great experience. A very steep learning curve initially.

 

That being said, over the years as we've become familiar with Sophos and it's services, we have added additional modules to add extra functionality. We currently have;

 

Firewall (with fullguard)

Advanced protection Endpoint (Client AV)

Advanced Server Protection (Server AV)

Wireless module (wireless controller, with 47 APs)

Mobile management (For our Chromebooks)

 

and we are currently looking and the new "edge switches" for top to bottom protection.

 

Yes it has it annoyances (Sophos STAS), but i think it's great on the whole.

 

EDIT: only real issue we had was it deciding not to clear out of data SSL certs........ Sophos remoted into the device and fixed the issue for us, explaining it was a bug in the recently updated firmware. It will be fixed in the next release.

 

http://www.edugeek.net/forums/internet-related-filtering-firewall/229187-unable-access-mail-google-com-cert-expired-sophos-xg.html

Edited November 29, 2022 by Jaan

[Wave9_Lee]

Currently sat looking at a bricked Sophos appliance. Experience to date sounds terrible but I'm new in post and so will give it a chance.

Short version of this...

Old version of firmware had an issue which caused the firewalls to go into failsafe and throttle traffic to the point of not being usable.

New firmware version fixes that but breaks wildcards in rules.

New firmware version fixes that but on loading it to the other partition, a couple of running services become stopped. Console stops working and web config becomes incredibly slow to respond. Firewall continues to pass traffic though so left it alone until this morning.

Reboot into new partition, failed boot. Console connects but will only read, cannot send any commands. Including factory reset. At this point we're at the stage of using the factory reset button on the appliance but need connectivity so the old Meraki is coming out of the cupboard to buy us time.

 

That's a snippet of experience to date. As I say though I'm new in post and the amount of problems I can see in tickets is wild... I'm actually wondering if there was a dodgy batch of memory or something that's gone into all of the appliances we have (17 of them purchased at the same time), because this can't be peoples day to day experience.

 

Sounds unusual to me, to say the least - if you'd like us to take a look and offer some advice/services, I'd be happy to arrange - drop me a PM if interested, think you would find us more responsive than vendor support

[michael2k6]

Thanks Lee, we've got our MSP on it and having exhausted our talent and theirs are now waiting on the senior Sophos team for RCA. Pretty certain I could cure it with a hard factory reset and restore but I want to figure this out before it happens when upgrading the firmware on the other 16 appliances.

 

I do feel like it's unusual and I'm hoping a reconfig at Easter solves some of the problems, and the firmware with the bug fixes solves the others.

[Jaan]

We are currently looking into replacing our on-prem Smoothwall box and like the look of Sophos' Firewall.

 

It would be great to know what you love about Sophos Firewall and what bugs you.

 

I would be interested in knowing how you have configured Sophos Firewall and see if it is similar to the Smoothwall way of doing things when it comes to web filtering.

 

Knowing what you know now would you still switch to Sophos Firewall over something like Smoothwall?

 

Any information you might be able to share on Sophos Firewall and your experiences using it would be really useful.

 

Where in the UK are you based?

[gmuirhead]

Currently sat looking at a bricked Sophos appliance. Experience to date sounds terrible but I'm new in post and so will give it a chance.

Short version of this...

Old version of firmware had an issue which caused the firewalls to go into failsafe and throttle traffic to the point of not being usable.

New firmware version fixes that but breaks wildcards in rules.

New firmware version fixes that but on loading it to the other partition, a couple of running services become stopped. Console stops working and web config becomes incredibly slow to respond. Firewall continues to pass traffic though so left it alone until this morning.

Reboot into new partition, failed boot. Console connects but will only read, cannot send any commands. Including factory reset. At this point we're at the stage of using the factory reset button on the appliance but need connectivity so the old Meraki is coming out of the cupboard to buy us time.

 

That's a snippet of experience to date. As I say though I'm new in post and the amount of problems I can see in tickets is wild... I'm actually wondering if there was a dodgy batch of memory or something that's gone into all of the appliances we have (17 of them purchased at the same time), because this can't be peoples day to day experience.

 

This may not be the same problem, but if you're on the XG series and on firmware 19.0 make sure you update to 19.0.1. There's a bug in 19.0 that seems to continually write to a log file on the config partition, causing the config partition to reach 100% full. Once that happens, the firewall will only boot into safe mode, passing no traffic at all. A factory reset seems to be the only option.