Sophos Firewall

These release notes are for Sophos Firewall (formerly known as Sophos XG Firewall).

See the product documentation at Sophos Firewall help.

Version 18.0 MR6 Build 655
Released on September 08, 2021

Enhancements

This section describes the security enhancements introduced in 18.0 MR6.

FragAttack: Resolved FragAttack vulnerabilities recently discovered in the Wi-Fi specification for all internal and add-on Wi-Fi modules for Sophos (XG) Firewall desktop series appliances. All other updates will follow as outlined in this advisory.

Troubleshooting reports (CTR):

Improved UX for troubleshooting report; eliminated UI time-out and freezing issue during CTR generation.
Ability to generate troubleshooting reports from the backend.
Capture full troubleshooting logs including log file rotation in the troubleshooting report.
Improved system snapshot in the troubleshooting report – added atop, top, env, and other useful commands in the output.

Version 18.0 MR5 Build 585
Released on April 29, 2021

New features

This section contains the new features for 18.0 MR5.

SSL VPN and WAF ports: SSL VPN traffic won’t flow through the hosted IP addresses configured for WAF rules if it shares the same port and protocol (example: TCP port 443) with WAF. For more information, see VPN settings.
Concurrent IPsec tunnels: Introduced more than 50 per cent increase in concurrent IPsec VPN tunnels across all hardware appliances. For more information, see the Advisory.
IPsec provisioning file: Provided provisioning file support for IPsec remote access VPNs. Users must install version 2.1 of the Sophos Connect client.

SD-WAN: Azure secure SD-WAN integration with XG Firewall

Published article: How to integrate XG Firewall with Azure Virtual WAN (secure SD-WAN)

Authentication: Azure AD integration with XG Firewall

Published article: How to integrate XG Firewall with Azure AD

Certificate signing requests (CSRs) and certificates

Streamlined forms and multiple SANs: Updated the forms for creating CSRs and certificates to allow more flexibility in adding Subject Alternative Names using DNS names and IP addresses, and removed unnecessary inputs.
Security enhancements: Addressed security concerns by preventing the download of private key material for CSRs and locally-signed certificates.
Upload, download, import: Provided new dialog boxes to allow CSR retrieval, and certificate upload for signing certificates (CAs) and leaf certificates. The boxes allow you to copy-paste PEM format certificates in addition to the DER, PKCS and PEM file transfer.
Locally-signed certificates: Self-signed certificates have been renamed locally-signed certificates.
Download format: CSRs and certificates can be downloaded as .csr and .crt files, respectively. They can't be downloaded as tar.gz files any longer.
Certificate with CA: Provided the option to add the certificate's CA to the CA list, using the same name when importing certificates with CA.
Workflow: Improvements to workflows and lists to make certificate management more intuitive.

Synchronized Security

Sophos Central registration for HA devices: Improved handling of Sophos Central registration and seamless deregistration process.
Notifications for missing heartbeats: Provided system commands on the CLI to delay or suppress notifications about endpoints going into missing heartbeat status after intentional actions, such as shutdown, restart, sleep, hibernate, and network switching. For more information, see the CLI help.

Remote Network Devices (REDs)

Removed RED 10 from the configuration options. These are end-of-life devices which haven't been supported since 18.0 MR3.
The firewall no longer supports the currently configured RED 10 tunnels. A warning to this effect will appear on the UI.

Central reporting

Released the CASB report and MSP Flex licensing on Central Firewall reporting.

Version 18.0 MR4 Build 506
Released on December 15, 2020

New features

This section contains the new features for 18.0 MR4.

Sophos Cloud Optix

For XG Firewall instances deployed in the AWS environment, you can see their VPC details in the topology section in Sophos Cloud Optix. For more details, see Cloud Optix help.

Amazon Web Services

Routing-based redundancy enhancements are available on the AWS platform.

Sophos Central

You can register HA devices with Sophos Central and manage them centrally. Both devices must be on 18.0 MR4. You must configure HA on the web admin console of XG Firewall.

High availability

Improvements to FastPath offload for HA active-passive configurations.

Sophos Connect client

The Sophos Connect client menu has been renamed IPsec (remote access). It's available on VPN > IPsec (remote access). You can configure the IPsec remote access configuration on this page. It also offers the advanced settings that were earlier available only through Sophos Connect Admin.

Turning off "Use as default gateway" on the web admin console may prevent connections from being established if the existing configuration files don't match the advanced settings. If you make changes to any of the advanced settings on the web admin console, you must send the updated .scx file to users for reimport into the Sophos Connect client.

Users can download the Sophos Connect client from VPN > Sophos Connect client (IPsec and SSL VPN) on the user portal. The available client versions and the remote access connections users can establish are as follows:

Windows: Sophos Connect client 2.0 (IPsec and SSL VPN connections).
macOS: Sophos Connect client 1.4 (Currently, only IPsec connections).

For more information, see remote access VPN help.

Web

XG Firewall blocks web pages categorized as highly objectionable criminal activity and hides the domain name in logs and reports. It won't implement any policy or exclusion that allows these pages.

RADIUS server

An optional Domain name field, which creates a local entry in the format user@domainname for RADIUS users, is available. The setting eliminates the issue of two entries being created automatically when authentication is based on both AD and RADIUS servers, for example, when the primary authentication method is AD, but VPN or multi-factor authentication uses RADIUS.

Synchronized Application Control

You can also set the automatic cleanup time to one month.

Enhancements

This section describes the security enhancements introduced in XG Firewall 18.0 MR4.

SSL VPN: XG Firewall enforces TLS 1.2 for SSL VPN connections.

Site-to-site connections: Both SSL VPN server and client firewalls must be on 18.0 MR4.
Remote access connections: These connections use OpenVPN client 2.3.8 and later. The Sophos Connect client 2.0 and legacy SSL VPN client enforce TLS 1.2.

Password security: Introduced a secure hash for storing the password of the admin (default administrator) account. The control center prompts the default administrator to change the current password. We recommend making this change. It's a one-time requirement.

Password complexity is turned on by default for all passwords, including those for the web admin console and the user portal.

Open SSL: XG Firewall now uses OpenSSL 1.0.2u.

SPX portal: A CAPTCHA is now required for the SPX portal to prevent automated attacks. You can't turn it off.

Version 18.0 MR3 Build 457
Released on October 13, 2020

New features

We introduced stronger protection for sensitive information and enhanced security.

Secure storage master key Enhanced security

We introduced a secure storage master key to provide extra protection for the account details stored on XG Firewall. The key encrypts sensitive information, such as passwords, secrets, and keys, preventing unauthorized access.

You must set the master key and store it in a secure location. If you lose it, you can't recover it. It has implications for backup-restore and import-export. For more details, see the support article.

High availability Enhanced security

The firewall now uses SHA256 encryption for your HA passphrase.

Access to some services Enhanced security

We recommend that you do not allow access to the XG Firewall consoles, user portal, and some services over the WAN zone. If you allow access from the WAN zone to the following services, warnings appear on the Administration > Device access page:

HTTPS (web admin console)
SSH (CLI)
Ping/Ping6
DNS: This applies when XG Firewall acts as the DNS server.
User portal

CAPTCHA Enhanced security

You can turn off the CAPTCHA from the CLI for the web admin console and the user portal. You can turn it off for only the VPN zone, or both VPN and WAN zones. Use the following syntax to enter the commands:

console> system captcha-authentication-global [enable] [disable] [show]

Selecting the consoles: [userportal] [webadminconsole]

console> system captcha-authentication-vpn [enable] [disable] [show]

Selecting the consoles: [userportal] [webadminconsole]

console> system captcha-authentication-global [enable] [disable] [show]

Users Enhanced security

You can't export or import local users from Authentication > Users any longer.

Other new features and enhancements

SSL VPN concurrent tunnels

XG Firewall now supports a larger number of concurrent SSL VPN tunnels. For more details, see SSL VPN concurrent tunnels.

Sophos Connect client

You can import groups from LDAP, AD, and other directories. XG Firewall allows access for users who belong to the groups based on the assigned policy.

Users who belong to these groups must sign in to the user portal. The sign-in adds these users to XG Firewall. XG Firewall can then authenticate the users and allow them to access the VPN connection.

Nutanix

XG Firewall is now available over the Nutanix AHV and Nutanix Flow infrastructure. XG Firewall secures traffic using the following two modes of operation:

Next-generation firewall protection for Nutanix infrastructure using route mode.
East-west protection for individual virtual machines and applications with Nutanix Flow micro-segmentation using non-IP bridge mode.

AWS

XG Firewall also supports C5, M5, and T3 instances. The firewall now supports CloudFormation Templates, eliminating the need to run the installation wizard in some instances.

Zones for custom gateways

You can assign any zone to a custom gateway.

You can create a virtual WAN zone on custom gateways for single arm usage after deployment. On single arm (a single interface in AWS or Azure), you can create more than one custom gateway and attach different zones to these gateways. You can then create access and security rules for traffic going to these zones.

XG Firewall doesn't allow the following actions:

You can't set the zone for the default gateway.
Custom gateways don't participate in load balancing even for the WAN zone.
XG Firewall doesn't apply the custom gateway zone if a migrated policy route applies to the traffic. These are policy routes migrated to 18.0 from earlier versions.
XG Firewall doesn't perform VPN lookups when the WAN zone is marked through a gateway.

Sophos Central Firewall Management

You can use Sophos Central to manage XG Firewall devices running in active-active and active-passive HA configurations. You can also use the functionality with the earlier 18.0 versions.

Sophos Central Firewall reporting (CFR)

Customers of CFR Advanced can save, schedule, export, and download reports from Sophos Central.

RED 10

You can't add RED 10 devices to XG Firewall any longer. The devices already in use will continue to work but without support.

Version 18.0 MR2 Build 403
Released on July 23, 2020

SFOS 18.0 MR2 is an interim release limited to offering early access to IPS engine version upgrade and related changes. We’ll make a broader release with new features and resolved issues shortly.

Version 18.0 MR1 Build 396

New features

Security hotfixes

The security hotfixes released until now are part of SFOS 18.0.1 MR1 (build 396). The hotfixes referred to in Fixing SQL injection vulnerability and malicious code execution in XG Firewall/SFOS, HF051220.1 and HF052220.1, are not required for this release.

RED devices

This version supports SD-RED 20 and 60 devices.

Quarantined emails

You can only release quarantined emails from the user portal. For details, see How to release quarantined email from quarantine spam digest email.

Version 18.0 Build 379
Released on April 30, 2020

New features

This describes the new features introduced in XG Firewall 18.0.

For detailed information on XG Firewall, go to the online help.

For an overview of the key features, please read What’s New in v18.

Xstream architecture

We are introducing the new Xstream architecture for XG Firewall - A new streaming packet processing architecture that provides extreme levels of protection and performance. The new architecture includes:

Xstream SSL inspection: Enable SSL inspection on your network without compromising network performance or the user experience. It delivers high-performance, high-connection-capacity support for TLS 1.3 and all modern cipher suites providing extreme SSL inspection performance across all ports, protocols, and applications. It also comes equipped with enterprise-grade controls to optimize security, privacy, and performance.
Xstream DPI engine: Enables comprehensive threat protection in a single high-performance streaming DPI engine with proxyless scanning of all traffic for AV, IPS, and web threats as well as providing application control and SSL inspection.
Xstream network flow FastPath: Provides the ultimate in performance by intelligently offloading traffic processing to transfer trusted traffic at wire speeds. FastPath offloading can be controlled through policy to accelerate important cloud application traffic or intelligently by the DPI engine based on traffic characteristics.

Sandstorm threat intelligence analysis

Sophos Sandstorm gains an added layer of artificial intelligence protection. All suspicious files are now subject to threat intelligence analysis in parallel with full sandbox analysis. Files are checked against the Sophos Labs threat intelligence database and subjected to our industry-leading deep learning. This identifies new and unknown malware quickly and efficiently, often rendering a verdict in seconds, to stop the latest zero-day threats before they get on the network.

Sophos Central Firewall Reporting and Management

This release includes support for new firewall reporting and management capabilities being launched simultaneously on Sophos Central including a rich powerful new reporting suite and group firewall management tools. To register with Sophos Central, go to Central synchronization.

NAT Enhancements

XG Firewall’s NAT configuration receives a major update as NAT rules are now decoupled from Firewall Rules enabling more powerful and flexible configuration options including Source (SNAT) and Destination (DNAT) in a single rule. NAT Rules can still be “snapped-in” to a Firewall Rule and edited in-place similar to other snap-in policies such as IPS and Web policies.

Improvements in managing firewall rules

Firewall rule management includes a new Add filter option with several fields and conditions to choose from. Adding a filter makes it easier to find firewall rules based on the selected filter criteria. Once selected, filters stay selected even when you move to other configuration screens.

You can manage multiple firewall rules at the same time (for example, select multiple rules to delete, enable or disable, attach to a group). Movement of rules across screens is possible, providing ease of use and management for larger rule sets.

Within the firewall rule there is an exclusion feature that provides a “negate” option in the matching criteria to reduce the management and ordering overhead of multiple rules. There’s also a UI option to reset the data transfer counter for a firewall rule to improve troubleshooting.

Wild card domains in WAF rules

You can now add wildcard domains in WAF (Web Application Firewall) rules. You can add wildcard subdomains (example: *.example.com) for both HTTP and HTTPS connections.

SD-WAN policy-based routing

Policy-based routing gains added SD-WAN flexibility and more granular control with the addition of application, user and group-based traffic selection criteria. Routing can be defined through either the primary or a backup gateway WAN connection and can be configured for replay direction.

Enhanced High Availability

You can now update more high availability settings without breaking HA and can also use the new QuickHA configuration mode.

Alerts and Notifications

There is a new option to choose from dozens of system and threat-related alerts and have notifications sent via email or SNMP.

Intelligent IPS signature selection

XG Firewall receives IPS signatures based on a number of intelligent filtering criteria, such as age, vendor, vulnerability type, and CVSS (Common Vulnerability Scoring System) to optimize protection and performance.

DKIM and BATV anti-spam protection

Anti-spam protection is improved with support for DomainKeys Identified Mail (DKIM). It detects forged sender addresses and Bounce Address Tag Validation (BATV) to determine whether the bounce address specified in the received email is valid and reject backscatter spam.

Kerberos authentication and NTLM

This release adds Kerberos authentication alongside the existing NTLM support for Microsoft Active Directory SSO, extending the range of authentication tools available for customers.

RADIUS time-out with two-factor authentication (2FA)

For customers using two-factor authentication (2FA) with RADIUS server authentication, the timeout value is now configurable allowing additional time to finish the authentication flow when necessary.

You can use the two-factor authentication (one-time password) for administrator access, user portal, IPsec and SSL VPN.

Bridge-VLAN support

VLANs are now supported on bridge interfaces, enabling greater networking flexibility and support for advanced inter-VLAN routing and bridging deployments.

SNMPv3

Support for SNMPv3 is added, providing more flexibility and security over SNMPv2.

SNMP (Simple Network Management Protocol) gives access to XG Firewall information, for example, status of the firewall, service availability, CPU, memory, and disk usage. XG Firewall now supports SNMPv3 users in addition to SNMPv1 and SNMPv2c protocols, ensuring confidentiality, message integrity, and validity of the user.

Route-based VPN

You can now create IPsec VPN connections that use tunnel interfaces as endpoints, making static and dynamic routing possible.

Web policy quota

Browsing quotas have been added to web policies, allowing you to set time quotas for browsing selected website categories. Users can choose how and when to consume their daily time quota.

Enhancements

This describes the enhancements introduced in XG Firewall 18.0.

Interface renaming: Interfaces can be renamed making networking configuration easier and more intuitive.
Jumbo Frame Support: Jumbo frames with more than 1500 byte payloads are now supported for added networking flexibility in high bandwidth environments.
Enhanced DDNS support: Provides support for enhanced HTTPS-based DDNS by adding five more DDNS providers: No-IP, DNS-O-Static, Google DNS, Namecheap, and FreeDNS.
Improved Synchronized Application Control verdict: If there is a pattern-based match conflict, Synchronized Application Control verdict is used. This gives more accurate application control.
DHCP relay enhancements for dynamic routing: Synchronizes dynamic routing updates (learned routes from OSPF) to DHCP relay, eliminating the need for manual reconfiguration.
Secure Syslog and logs in the standard Syslog format: Provides the option to fetch logs in the standard syslog format using secure TLS.
Dynamic GeoIP (IP to country mapping) database: The GeoIP database is now updated dynamically in real time from the Up2Date servers. Make sure you always use the appropriate country-specific filters and policies.
VMware Tools upgrade and integration with VMware Site Recovery Manager (SRM): Supports virtual device integration of the latest VMware Tools version (v10.3.10) with reboot, shutdown, and clone-like functionalities. The release also supports integration with Site Recovery Manager (SRM), the disaster recovery and business continuity solution from VMware which automates the transfer of virtual machines to a local or remote recovery site.
Log viewer enhancements: The log viewer gets several enhancements with one-click actions available right from the logs to narrow search results, filter log entries, or create or modify policies on the fly.
New filter and search options, including the choice to disable signatures, block a source IP address, edit interfaces, and modify IPS, app control, or web filtering policies.
Live Connections: The live connections pages for IPv4 and IPv6 provide a lot of new insights into concurrent traffic in your network.
Access points can be restarted from the web admin console: You can now restart wireless access points from the web admin console. To restart an access point, select an access point and click Restart.
Sophos Connect address range: Sophos Connect lease now supports more than 255 IP addresses in the address range. XG Firewall now supports class B networks for IP addresses leased to the Sophos Connect client. You can change the last two octets.

Resolved issues

Version 18.0 MR6 Build 655

Resolved issues, listed by ID, description, explanation and workaround.
Issue ID	Component	Description
NC-70099	Authentication	Error while accessing XG web admin
NC-73734	Date/Time Zone	Reports showing wrong time zone due to /etc/timezone is not updated during restore
NC-69495	Firewall	XG210 rebooting frequently [skb->sk corruption]
NC-69503	Firewall, VFP-Firewall	Possible IRQ lock inversion dependency
NC-69558	Firewall	XG750 v18.0.3.457 crash: tcp_v4_rcv+0xb14/0xbb0
NC-72153	Firewall	VLAN on bridge with fastpath enabled does not pass traffic
NC-75844	HA	Traffic issues on HA Active-Active Mode
NC-63177	IPS-DAQ-NSE	DPI causing trouble with SSL 2.0 client hello's
NC-69344	IPS-DAQ-NSE	Improved bandwidth of TLS connections in DPI mode by updating the TCP receive window negotiation algorithm
NC-64935	IPsec	Alerts generated by Central when auxiliary unit IPsec log has REKEY event
NC-69335	IPsec	Unable to delete IPSec Connection which is on second UI page
NC-69446	IPsec	XFRM interface fails to get Connected and it's status becomes N/A upon a reboot when RBVPN is on Cellular WAN
NC-74978	IPsec	Charon crash in send_sso
NC-70057	Network Utils	Intermittent WAN connectivity issue for firewall running on Azure
NC-70783	RED	The GUI access of the Primary appliance is lost when we save RED interface.
NC-71333	SDWAN Routing	Incoming VPN traffic doesn't follow SDWAN policy
NC-72419	SSLVPN	SSLVPN remote access: push_reply does not include updated permitted lan networks
NC-77589	UI Framework	UI times out when configuring an IPSec tunnel
NRF-517	RED	SD-RED 60: LAN switch VLAN configuration is lost after some time.

Version 18.0 MR5 Build 586

Resolved issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-71491	SNMP	Migration issue when two SNMP communities are configured with the same source IP address.
NC-71456	Sophos Connect client	Unable to download the Sophos Connect Client from user portal for macOS and Windows.
NC-71582	Sophos Connect client	Connection failure when the preshared key length is 128 or more characters.
NC-72172	VPN	Preshared key for IPsec remote access and L2TP shows the encrypted value.
NC-65239	Authentication	SATC users not authenticated sporadically.
NC-62902	Authentication, Backup-restore	Unable to upload backup from 17.5 MR12 to 17.5 MR14.
NC-66124	Bridge	VLAN of bridge interface doesn't follow the ZoneID for device access.
NC-68732	Central management	XG86W_AM01 firewalls are unable to apply configurations received from Sophos Central.
NC-69835	Central management	Unable to import configuration from XG86W.
NC-69683	CROS to SFOS migration	Migration issues from CR to XG Firewall.
NC-60180	CSC	Overrides the specified schedule after failover in active-passive.
NC-67759	Diagnostics	System graph: In Japanese language, memory usage for one month shows one week in the heading.
NC-67605	Email	Unable to turn on DKIM verification.
NC-65346	Email	Unable to see DKIM verification emails on the quarantine page in user portal even with the default setting.
NC-63436	Email	Legacy mode: Unable to delete spam check exception.
NC-51915	Email	Selecting a certificate isn't mandatory in notification settings even when SSL/TLS is selected.
NC-66977	Firewall	Couldn't unload SIP helper in HA mode.
NC-64917	Firewall	Firewall restarts with bridge deployment in HA mode.
NC-64820	Firewall	Awarrenhttp proxy blocks inbound connections on port 443.
NC-63772	Firewall	Policy test for firewall rule doesn't show correct results.
NC-63612	Firewall	Firewall restarts when load balancing DNAT traffic with an FQDN (dynamic IP addresses).
NC-67274	HA	Unable to disable HA when there's an SSL/TLS rule specifying source and destination zones.
NC-66978	HA	HA page doesn't respond after turning on QuickHA.
NC-53059	HA	HA active-active load balancing interrupts remote printing.
NC-70928	IPS, DAQ, NSE	Certificate request message isn't passed to client when SSL/TLS rules apply.
NC-66682	IPS engine	After migration from version 17.5 to 18.0, IPS Logs for WAF show the LAN interface IP address as the source IP address instead of the public IP address.
NC-55213	IPsec	IPsec tunnel up or down: Several email notifications are sent when the connection is terminated.
NC-64309	Network utilities	When ping is set to IPv6, it switches to IPv4 on the web admin console, but IPv6 interfaces are shown.
NC-59619	Policy routing	Unable to create policy route when Name has an apostrophe (').
NC-69693	RED	All RED 50 devices disconnect repeatedly.
NC-68724	RED	Changing the configuration on a RED interface disconnects all RED interfaces.
NC-63136	RED	Configuration change on one RED tunnel causes all other RED tunnels to reset.
NC-64045	RED	If RED is configured, the firewall must not allow transparent-split or 3G failover configuration.
NC-64010	RED	Confirmation message states beta firmware instead of unified firmware.
NC-63179	RED	RED interfaces show they are connected to an incorrect IP address.
NC-70742	Reporting	In HA, the newly active XG Firewall device couldn't update information on Sophos Central after changing from passive to active device.
NC-66437	Reporting	No user reporting statistics after firmware upgrade.
NC-66024	Reporting	Blocked web report doesn't appear for October 2020.
NC-65522	Reporting	Time filter shows blank or inaccurrate output in log viewer.
NC-60391	Reporting	Custom logo stretches in executive reports from the 2nd page onwards.
NC-65148	SNMP	SNMP shows incorrect license details.
NC-64908	SSL VPN	SSL VPN disconnects, but status shows it's connected.
NC-64773	SSLVPN	Packet loss and latency occur on SSL VPN when the tunnel connects or disconnects in version 18.0 MR3.
NC-67364	Static routing	Country blocking through firewall rule doesn't work.
NC-67178	Static routing	Country blocking rule blocks URLs.
NC-62682	Static routing	Netherlands appears in two country groups.
NC-62259	Synchronized Application Control	SAC menu doesn't load.
NC-66616	UI framework	Sometimes the web admin console and user portal pages don't load due to a memory issue.
NC-67365	UI framework	Administrator user is unable to sign in to the user portal when the login disclaimer is on in version 18.5 MR4.
NC-64984	UI framework	Page load issue when refreshing the packet capture page with wrap buffer on.
NC-64758	UI framework	Users are signed out of the user portal when they click Install under Configuration for IPsec VPN client for Apple iOS.
NC-60856	UI framework	False positive reported in third-party scan.
NC-57742	WAF	Incorrect WAF rule ID resolution in syslog.log.
NC-63996	WebInSnort	Delay in connecting to an SSL/TLS-protected FTP server.
NC-66028	WWAN	USB doesn't connect after an upgrade from version 17.5 MR12 to 17.5 MR14 or 18.0.
NRF-447	RED	Unable to connect RED 20 to XG Firewall.
NAF-33	Access Point, Firmware	Wireless devices disconnect intermittently when they connect to SSIDs containing special characters.
NAF-19	Access Point, Firmware	Corruption of calibration data on AP15.

Version 18.0 MR4 Build 506

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-59149	API framework	CSC stops responding since all 16 workers remain busy.
NC-50703	Authentication	Access server restarted with coredump using STAS and Chrome SSO.
NC-54576	Authentication	Sophos Connect client connections exhaust the virtual IP pool.
NC-57273	Authentication	Need to create users for RADIUS in UPN format.
NC-59129	Authentication	Authentication fails due to SSL VPN (MAC BINDING). Logging doesn't carry any information for the cause.
NC-61017	AWS	AWS: TX-DRP increases constantly and affects production traffic.
NC-59574	Base System (deprecated)	Sometimes hotfix timer is deleted.
NC-58587	Clientless Access	Clientless access service crashes.
NC-59411	DNS	Unable to add underscore character in DNS host entry.
NC-54604	Email	POPs/IMAPs (warren) dropping connection due to SSL cache error.
NC-59897	Email	Specific inbound mail not being scanned for malware.
NC-60858	Email	PDF attachment in inbound email got stripped by email protection.
NC-63870	Email	Firewall creates infinite connections to itself on Port 25.
NC-59406	Firewall	Kernel crashed due to conntrack loop.
NC-59809	Firewall	Loopback rule not hit when created using server access assistance (DNAT) wizard and WAN interface configured with network rather than host.
NC-59929	Firewall	Firewall rules not visible on GUI. Page stuck on loading.
NC-60078	Firewall	WAF: Certificate can't be edited for API XML import.
NC-61226	Firewall	Different destination IP address is shown in log viewer for Allow and Drop firewall rule when DNAT is on.
NC-61250	Firewall	Memory leak (snort) on XG 430 rev. 2 running SFOS v18.
NC-61282	Firewall, HA	Failed to enable HA when a new XG Firewall replaces an existing XG Firewall.
NC-62001	Firewall	Kernel panic on XG 550.
NC-62196	Firewall	Policy test for firewall, SSL/TLS and web with day doesn't match schedule rule.
NC-63429	Firewall	Kernel stack is corrupted in bitmap hostset netlink dump.
NC-65492	Firewall	User isn't able to generate access code for policy override.
NC-59747	Firmware Management	Upgrade to 18.0 SR4 failed on Azure.
NC-58618	FQDN	[coredump]fqdnd in Version 18.0.2.
NC-62868	HA	HA - Certificate sync fails in auxiliary device.
NC-64269	HA	IPv6 MAC-based rule not working when traffic is load balanced to the auxiliary device.
NC-64907	HA	Auxiliary appliance crashes when broadcast packet is generated from it.
NC-65158	Hotspot	Voucher export shows encrypted PSKs with secure storage master key.
NC-57661	IPS-DAQ-NSE NEMSPR-98	Browser "insecure connection" message when NSE is on but not decrypting.
NC-58391	IPS-DAQ-NSE	TLS inspection causing trouble with incoming traffic.
NC-61498	IPS-DAQ-NSE	Symantec endpoint updates URL failed when DPI interferes.
NC-63242	IPS-DAQ-NSE	SSL/TLS inspection causing outbound traffic issues with Veeam backups.
NC-59774	IPsec	Charon shows dead status.
NC-59775	IPsec	Sporadic connection interruption to local XG Firewall after IPsec rekeying.
NC-60361	IPsec	Incorrect IKE_SA proposal combination being sent intermittently by XG Firewall during IKE_SA rekeying.
NC-61092	IPsec	Strongswan not creating default route in table 220.
NC-62749	IPsec	Responder not accepting SPI values after its ISP disconnects.
NC-61101	L2TP	Symlink not created for L2TP remote access.
NC-62729	L2TP	L2TP connection on alias interface not working since update to 18.0.
NC-59563	Licensing	Apostrophe in email address prevents the "Administration" menu from loading.
NC-63117	Logging Framework	Garner is core-dumping frequently.
NC-61535	Network Utils	Diagnostics, tools, ping utility not working with PPPoE interface.
NC-62654	nSXLd	NSXLD Coredump caused the device not to respond.
NC-59724	RED	Backup from 17.5 MR10 doesn't restore on 18.0.
NC-60081	RED	Unable to specify username and password when using GSM 3G/UMTS failover.
NC-60158	RED	FQDN host group appearing in RED standard-split network configuration.
NC-60854	RED	RED S2S tunnel static routes disappear on firmware update.
NC-63803	RED	FailSafe mode after backup restore. Unable to start RED service.
NC-55003	Reporting	Keyword search engine report not working.
NC-59106	Reporting	Security Audit Report (SAR) missing information under "Number of attacks by severity level".
NC-60430	Reporting	XG Firewall sends duplicate copies of schedule executive report.
NC-60851	Reporting	Scheduled reports aren't sent.
NC-62804	SecurityHeartbeat	Registration to central security heartbeat doesn't work through upstream proxy.
NC-62182	SFM-SCFM	Administrator unable to change password of 18.0 device from SFM/CFM.
NC-61313	SNMP	Memory utilization mismatch between UI and atop/SNMP.
NC-64454	SNMP	XG 86: /tmp partition becomes 100 per cent full due to snmpd logs.
NC-53896	SSLVPN	Enforce TLS 1.2 on SSL VPN connections.
NC-60302	SSLVPN	All the SSL VPN live connected users get disconnected when administrator changes the group of a single SSL VPN connected user.
NC-60184	UI Framework	Missing HTTP security headers for HSTS and CSP.
NC-61206	Up2Date Client	Firewall fails to fetch hotfixes and ppatterns: File /conf/certificate/u2dclient.pem missing.
NC-62689	VFP-Firewall	When FastPath (firewall-acceleration) is on, traceroute shows time-out on the XG Firewall hop.
NC-63783	VFP-Firewall	Unable to start IPS.
NC-64470	VFP-Firewall	Auto reboot/nmi_cpu_backtrace due to VFP. Turning off firewall acceleration fixed the issue.
NC-63058	VirtualAppliance	Incorrect virtual XG Firewall model name appears in GUI and CLI.
NC-47994	Web	Pattern updates for SAVI and AVIRA are failing.
NC-54173	Web	URL Group: Add URL control fails when there's leading or trailing white space.
NC-51888	WebInSnort	IPP/AirPrint not accessible after upgrade of software appliance firmware to 18.0 EAP1.
NC-54978	WebInSnort	When an HTTPS connection isn't decrypted, reports show a hit to the site but no bytes are sent or received.
NC-62448	WebInSnort	Core dump on Snort.
NC-63515	WebInSnort	NSE: Unsupported EC type with application control and web policy.
NC-64875	WebInSnort	HTTP pipelining errors in DPI mode with non-pipelined traffic.
NC-60615	Firmware	Ambiguous alert shown during firmware upgrade to 18.0 MR1 for HA.
NC-59809	NAT	Loopback rule created using server access assistant and WAN interface configured with network not matched.
NC-61507 and NC-52716	Route-based VPN	XFRM traffic dropped when there's a NAT MASQ rule on the listening interface.

Version 18.0 MR3 Build 457

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-58229	Authentication	Failing Sophos AV and Avira AV pattern updates.
NC-51876	Core Utils	Weak SSHv2 key exchange algorithms.
NC-58144	DNS	XG Firewall reporting its own lookups in ATP causing a flood of events.
NC-54542	Email	Email banner added to incoming emails.
NC-59396	Email	Blocked senders able to send emails.
NC-58159	Firewall	Unable to ping external IP addresses from the auxiliary appliance console.
NC-58356	Firewall	Direct proxy traffic doesn't work when RBVPN is configured.
NC-58402	Firewall	Firewall restarts randomly.
NC-59399	Firewall	ERROR(0x03): Failed to migrate configuration. Loading the default configuration.
NC-60713	Firewall	User portal hotspot voucher configuration times out.
NC-60848	Firewall	HA cluster: Both devices restart unexpectedly.
NC-59063	Firmware Management	Remove expired CAs from SFOS.
NC-44455	HA	System-originated traffic not flowing from the auxiliary device when SNAT policy is configured for system-originated traffic.
NC-62850	HA	Filesystem anomaly in /conf.
NC-58295	IPsec	Dropped due to TLS engine error: STREAM_INTERFACE_ERROR.
NC-58416	IPsec	IKE SA re-keying doesn't re-initiate itself after re-transmission time-out of 5 attempts.
NC-58499	IPsec	Sophos Connect client "IP is supposed to be added in the ##ALL_IPSEC_RW".
NC-58687	IPsec	IPsec tunnel not re-initiated after PPPoE reconnect.
NC-58075	Netflow/IPFIX	Netflow data not sending interface ID.
NC-55698	nSXLd	Unable to add new domain in custom category.
NC-62029	PPPoE	PPPoE link doesn't reconnect after disconnecting.
NC-57819	RED	XG Site-to-site RED tunnel disconnects randomly with 17.5.MR10 and 18.0.
NC-60240	RED	Interfaces page is blank after adding SD-RED 60 with PoE selected.
NC-61509	RED	RCA site-to-site RED tunnel static routes disappear with firewall update.
NC-59204	SFM-SCFM	Task queue pending but never applies with XG 86W appliance.
NC-60599	SFM-SCFM	Task queue pending but never applies because of improper encoding.
NC-62304	SFM-SCFM	Notification email sent from XG Firewall shows the wrong Sophos Central administrator.
NC-61956	UI Framework	Web admin console and user portal not accessible because of space issue in certificate name.
NC-62218	UI Framework	Post-auth command injection through the user portal 1/2 (CVE-2020-17352).
NC-62222	UI Framework	Post-auth command injection through the user portal 2/2 (CVE-2020-17352).
NC-58960	Up2Date Client	HA: IPS service observed DEAD.
NC-59064	Web	Appliance becomes unresponsive: awarrenhttp high memory consumption.
NC-60719	WebInSnort	DPI engine intermittently causing website to load slowly.
NC-61367	CAPTCHA	CAPTCHA issue for IPv6 on LAN zone is resolved.

Version 18.0 MR1 Build 396

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-30903	Authentication	STAS configuration can be edited through the GUI on AUX machine.
NC-50703	Authentication	Access server restarted with coredump using STAS and Chrome SSO.
NC-50716	Authentication	Cannot import LDAP server through the XMLAPI if client certificate is "None".
NC-54689	Authentication	Support download certificate for iOS 13 and above.
NC-55277	Authentication	Service "Chromebook SSO" is missing on Zone page.
NC-51660	Backup-Restore	Restore failed using a backup of XG135 on SG230 appliance.
NC-55015	Bridge	Wi-Fi zone is not displayed while creating bridge.
NC-55356	Bridge	TCP connection fails for VLAN on bridge with HA Active-Active when source_client IP address is odd.
NC-52616	Certificates	Add support for uploading of CRLs in DER format.
NC-55739	Certificates	EC certificate shows up as "RSA" in SSLx CA certificate drop-down list.
NC-55305	CM (Zero Touch)	System doesn't restart on changing time zone when configured through ZeroTouch.
NC-55617	CM (Zero Touch)	Wrong error message in log viewer after ZeroTouch process.
NC-55909	Core Utils	Unable to see application object page on SFM.
NC-30452	CSC	Dynamic interface addresses not showing on AUX after failover.
NC-55386	Dynamic Routing (PIM)	PIM-SM import fails with LAG as dependent entity.
NC-55625	Dynamic Routing (PIM)	In HA with multicast interface, routes are not getting updated in the AUX routing table.
NC-55461	Email	After adding or editing FQDN host with smarthost, it is not displayed on the list until the page is refreshed.
NC-58898	Email	Potential RCE through heap overflow in awarrensmtp (CVE-2020-11503).
NC-55635	Firewall	Display filter for forwarded traffic is not working properly on packet capture page.
NC-55657	Firewall	HA backup restore fails when port name is different in backup and appliance.
NC-55884	Firewall	IPS policy ID and appfilter ID not displaying in firewall allow log in the log viewer.
NC-55943	Firewall	Failed to resume existing connection after removal of heartbeat from firewall configuration.
NC-57084	Firewall	Custom DMZ not listed in dedicated link HA configuration.
NC-44938	Firmware Management, UX	Web UI does not show reasons for firmware upload failure.
NC-55756	Gateway Management	Gateway isn't deleted from SFM UI after being deleted from SFM.
NC-55552	HA	WWAN interface showing in HA monitoring ports.
NC-55281	Import-Export Framework	Full configuration import fails when using third-party certificate for webadmin setting.
NC-55171	Interface Management	VLAN Interface IP is not assigned via DHCP when gateway name uses some special characters.
NC-55442	Interface Management	DNS name lookup showing incorrect message.
NC-55462	Interface Management	Import fails on configuring Alias over VLAN.
NC-55659	Interface Management	Invalid gateway IP and network IP configured using API for IPv6.
NC-56733	Interface Management	Patch PPPd (CVE-2020-8597).
NC-51776	IPS Engine	Edit IPS custom rule protocol doesn't work after creation.
NC-51558	IPsec	Add warning message before deleting xfrm IPsec tunnel.
NC-55309	Logging	Local ACL rule not created through log viewer for IPv4 and IPv6.
NC-50413	Logging Framework	Gateway up event log for PPPoE interface not always shown in the log viewer.
NC-55346	Logging Framework	Clear All for "Content filtering" does not clear SSL/TLS filter option.
NC-56831	Policy Routing	SIP traffic doesn't work at times with SD-WAN policy route.
NC-46009	SecurityHeartbeat	Spontaneous reconnect of many endpoints.
NC-51562	SecurityHeartbeat	Heartbeat service not started after HA failover.
NC-52225	Synchronized App Control	SAC page loading issues as the list of apps increases.
NC-54078	UI Framework	Internet Explorer UI issue on certain rules and policies pages.
NC-56821	Up2Date Client	SSL VPN downloading with 0 KB.
NC-54007	Web	File type block messages sometimes contain mimetype rather than file type.
NC-60108	API Framework	Pre-auth SQLi in API interface OPCODE.
NC-59156	CSC	Traffic not passing after upgrade to SF 18.0 MR1.
NC-59300	Email	Blind pre-auth SQLi in spxd on port 8094.
NC-23160	Firewall	LAN test failed in Port3 in SFLoader for 125/135 desktop model.
NC-59586	Network Utils	Remove MD5 remnant.
NC-46109	RED	No proper forwarding if bridging 3 or more RED site-to-site tunnels on XG Firewall.
NC-50796	RED	All RED site-to-site tunnels restart when configuring one RED interface.
NC-60162	Reporting	Error 500 displayed for web admin console and user portal after HF4.1 applied on virtual XG Firewall.
NC-60171	Security, UI Framework	Admin to super admin privilege escalation.
NC-59427	SFM-SCFM	SQLi in user portal.
NC-59932	UI Framework	Unable to sign in to the user portal or web admin console using IE after HF4.1.

Version 18.0 Build 379

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-59408	API Framework, UI Framework	SQLi prevention in hybrid request - ORM fields and mode parameters (CVE-2020-12271).
NC-58898	Email	Potential RCE through heap overflow in awarrensmtp (CVE-2020-11503).
NC-59300	Email	Blind pre-auth SQLi in spxd on port 8094.
NC-59454	UI Framework	Enable apache access logs.

Version 18.0 Build 354

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-57910	Base System (deprecated)	Unable to upgrade from 17.5 MR9 to 18.0 GA.
NC-56732	Firewall	Kernel panic after update to 18.0 GA due to SSLVPN.
NC-57067	IPsec	Sophos Connect lease doesn't support more than 255 IP addresses in the address range.

Version 18.0 Build 339

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-54339	Config Migration Framework	17.5 MR10 to 18.0 GA migration support
NC-56550	Policy Routing	SD-WAN policy routing screen smudge with blue strip
NC-56201	RED	Backup/Restore failure from 17.5 MR9 to 18.0 with specific RED configuration
NC-56397	Web	Certificate error received by the user

Version 18.0 Build 321

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-33664	App Signature	Unable to block Psiphon
NC-42675	Authentication	access_server returns 'Login Failed' if two awarrenhttp threads call in at same time
NC-44686	Authentication	Import/export of AUTHCTA has missing and incorrect values
NC-48116	Authentication	Importing users via csv file with special character in password fails
NC-50521	Authentication	User group assignment issue with LDAP users
NC-54642	Authentication	Authentication not working due to high CPU utilization of access_server
NC-50136	Backup-Restore	ISP failover for 2 PPPoE connections is not working for local LAN systems
NC-51979	Backup-Restore	Can't reflect time zone from restoring backup file after factory resetting
NC-32336	Base System	gpg vulnerability (CVE-2018-12020)
NC-42490	Base System	Validation function for legacy objects does not get called
NC-55640	Bridge	Firewall rule id not matching if traffic is going into wifi interface
NC-45935	Certificates	Fingerprint not updated on Default CA regenerate event
NC-49023	Certificates	Webproxy signing with non default certificate when using HTTPS Scanning
NC-54562	Certificates	CAs are missing after update from v18 EAP2 to EAP3
NC-29869	Clientless Access(HTTP/HTTPS)	"Internal Server Error" after adding many VPN bookmarks
NC-48516	Config Migration Framework	Configuration migration log on console is wrong in case of failed migration
NC-55270	Config Migration Framework	Report migration failed
NC-49648	CSC	API Get BridgePair requests sometimes report incorrectly "No. of records Zero."
NC-52857	CSC	One time scheduler doesn't work as expected in case of DST
NC-51717	DDNS, Email	DDNS uses wrong IP when interface is configured with PPPoE + Alias
NC-38763	DHCP	IP not leased to DHCP only interface when update from stateless
NC-38795	DHCP	IPv6 not removed from DB while disable DHCPv6 manage flags from RA server
NC-38930	DHCP	Editing DHCPv6 interface with auto configuration does not get IP from DHCPv6 server
NC-39157	DHCP	DHCPv6 client option "Accept other configuration from DHCP" is not working
NC-50214	DHCP	DHCP server dead with specific configuration
NC-51957	Documentation	Showing fastpath load failed with command "console> system firewall-acceleration show"
NC-48712	Email	Antivirus service in stopped state, cannot recover it
NC-51340	Email	Mailscanner child process causing OOM events when editing blocked senders list
NC-51347	Email	Error message "undefined" received when trying to add host
NC-51883	Email	API error 599 when performing GetRequest for various email modules
NC-52212	Email	Reject/Drop action not work correctly for oversized mails
NC-53016	Email	Email Blocked Senders cannot be updated
NC-55138	Email	SAVI AV update failed
NC-22659	Firewall	IPtable chains not created for firewall rule whose name contains blackslash '\\\\\'
NC-30482	Firewall	DNAT rules stop working after every reboot when migrating from UTM to SFOS
NC-36616	Firewall	Firewall group not available in APIhelpdoc
NC-37775	Firewall	Configuring over 20 time schedulers on the various firewall rules is causing CSC freeze
NC-43017	Firewall	Full config export does not include Security Policy group
NC-43415	Firewall	In the firewall rule, types of services are not translated
NC-48803	Firewall	Virtual Host update is calling on every FQDN IP update even its not used in virtual host configuration
NC-49101	Firewall	Group description delete issue in firewall
NC-49678	Firewall	Default ICMP service not matching in policy test tool
NC-50222	Firewall	Firewall rule position display is incorrect on rule deletion
NC-50549	Firewall	Drop packet does not show all the information for firewall rule ID 0 drop compare to v17.5
NC-50712	Firewall	NAT rules UI error
NC-50949	Firewall	Wrong ARP behavior in relation to DNAT rules
NC-51867	Firewall	Denied firewall logs send to garner for allowed firewall rule even if logging is disabled
NC-51964	Firewall	DNAT rule stopped working after every reboot
NC-52395	Firewall	Getting wrong username in admin event for firewall rule group name update
NC-52429	Firewall	Web access lost for 10+ minutes after HA fail-over
NC-52638	Firewall	WAF is not able to connect to webserver via IPsec tunnel
NC-52662	Firewall	Continuous receiving 'fw_fp_invalidate_microflows:459: Queueing invalidate work ffff8801ed1bb5c0' error in syslog
NC-52853	Firewall	Observed feedback channel plugin of garner core dump on XG330
NC-52873	Firewall	Kernel warning message 'RIP: 0010:tcp_send_loss_probe+0x13f/0x1c0' observed in syslog
NC-53364	Firewall	Firewall rules are not getting created correctly using XML API
NC-53988	Firewall	Kernel panic on XG450 appliance
NC-54038	Firewall	Wrong notification message displayed after disabling firewall rule
NC-55261	Firewall	Appliance crashing with Kernel Panic
NC-55789	Firewall	Ipuser ipset dumps when user is authenticated via STAS
NC-47482	Firmware Management	Firmware mismatch issue - both firmware slots showing same firmware
NC-52441	Firmware Management	Some time firmware 'install' opcode getting timeout and installation failed
NC-38800	HA	Incorrect error message when configure HA A-A with DHCP interface
NC-39015	HA	Unable to configure peer administration port for HA A-P when one of IP family of the interface is Dynamic IP assignment
NC-30485	Import-Export Framework	Export full configuration some time fails with error - 'The request could not be completed'
NC-39229	Interface Management	XG unsynced with SFM when unbind any interface from SFM
NC-46514	Interface Management	Cyberoam backup restore fails when DHCPv6 interface configured
NC-48450	Interface Management	Table for interface widget is not visible in control center page
NC-49938	Interface Management	Some time traffic drop in bridge mode
NC-48956	IPS Engine	Modify IPS TCP Anomaly Detection setting to disabled in default setting
NC-53875	IPS Engine	IPS keeps getting started because of page allocation failure
NC-51568	IPS-DAQ	Coredump in snort
NC-52085	IPS-DAQ	Wget not working for IPv6 sites in bridge mode - SSL decrypt not working
NC-53363	IPS-DAQ	Internet traffic hang and all traffic dropped
NC-52641	IPS-DAQ-NSE	IPS Service DEAD
NC-54310	IPS-DAQ-NSE	CC terminals not establish a connection with server
NC-29370	IPsec	Tunnel is getting established even though PFS is disabled on the VPN client side and enabled in SFOS IPsec profile
NC-49919	IPsec	Dgd service stopped and unable to start
NC-33848	LAG	LAG advanced options not working when LAG is member of Bridge
NC-40683	LAG	LAG active mode import-export is not working
NC-52090	Logging	LogViewer: "Action is not Allowed" filtering not working in detailed view
NC-52762	Logging	LogViewer: system mentioned in upper case
NC-46114	Logging Framework	Improper input validation and email notification after failed login (Webadmin, SSH, ...)
NC-50127	Logging Framework	Garner coredump in HA setup at handle_sync_input
NC-51942	Logging Framework	Policy Test Tool not working if firewall rule created with destination network as country or country group
NC-37839	nSXLd	Proxy authentication is not cleared after config reload
NC-37841	nSXLd	Keywords are not deleted when custom web category is deleted
NC-54525	RED	S2S RED tunnel doesn't established on SFOS after EAP2 to EAP3 upgrade
NC-28022	Reporting	Incomplete field names on data anonymization page
NC-42864	Reporting	Reports downloaded in PDF format have logo too close to the first line in most pages
NC-43183	Reporting	When data anonymization is enabled, scheduled reports are showing "Not available" instead of anonymized string
NC-45154	Reporting	Cannot specify hour and minute properly in Detailed Custom Reports
NC-45236	Reporting	Reports sent 1 hour later than scheduled
NC-46178	Reporting	"Web Risks & Usage Visibility" not showing any data
NC-49273	Reporting	Filtering on blocked user activities not working as expected
NC-52120	Reporting	Daily Reports are received but it delayed by different time
NC-52125	Reporting	UTQ user data is empty in SAR report but populated in GUI dashboard report
NC-53072	Reporting	Events reports (Admin, Authentication and System) are not generating due to db query for insert query getting failed
NC-53369	Reporting	Application Categories shown as "Unclassified"
NC-54177	Reporting	UTQ not generating due to change in web categories names
NC-48718	Service Object	Unable to edit service object that is assigned to a firewall rule
NC-47585	SFM-SCFM	Backedup 'central reporting' config is not maintained after Restoring config
NC-53043	SNMP	Wrong data is displayed in SNMP query for CPU usage
NC-47348	SSLVPN	LogViewer logs are not generated for ssl vpn connection up or down events
NC-55228	SSLVPN	Site2site - SSLVPN client in HA is not initiating connection after active node shut down
NC-54150	Static Routing	Data insertion is failing if large number of connections are present and Live Connection page is loaded
NC-54314	Static Routing	Negative value is displayed in upstream/downstream bandwidth column
NC-51673	UI Framework	User portal redirect loop when using non-standard port
NC-55193	VFP-Firewall	Port self test reboots appliance - V18 fastpath
NC-23045	WAF	WAF - Increase default TLS version to v1.2
NC-51952	WAF	WAF firewall rule update failed after migration from 17.5 MR8 to 18.0 EAP1
NC-55034	WAF	Web server timeout of 0 leads to syntax error in reverseproxy.conf
NC-51156	Web	Dynamic app filter rules which do not contain any applications is enforced for all applications in WIS
NC-53402	Web	Appliance auto reboot due to OOM (out of memory)
NC-53709	Web	Tiktok video not working with plain firewall rule with SSL/TLS enabled
NC-54421	Web	SSLx Exception based on SAC does not work
NC-44346	WWAN	Celullar WAN does not takeover again on failover

Known issues

Known issues, listed by ID, description, explanation and workaround.
Issue ID	Description	Explanation	Workaround
NC-87676	WAF	WAF may stop working after a backup is restored for firewalls that first started with a version earlier than 18.0 GA and are currently running a version later than 18.0 GA.	If WAF does't start and reverseproxy.log shows the following message, contact Sophos Support: Invalid encrypted key
NC-85454	PPPoE	When more than one PPPoE link is configured on SFOS, and you upgrade the firmware to 18.5.MR2 build #380, passwords of the PPPoE links are lost for all but any one PPPoE link. So, only one PPPoE link remains functional after migration. The other links don't connect because of authentication failure.	Edit the PPPoE interface configuration, update the password, and save the configuration.
NC-85343	Network utils	Unable to update interface name using the following terms: "port", "eth", or "ge".	The names of physical and virtual interfaces, wireless networks, and IP tunnels can't start with system-reserved names, such as port, eth, ge, and xfrm, except when the Name is the same as the Hardware name.
NC-85313	API framework	No status code in API response.	You must use one of the tags <Set>, <Get>, or <Remove>, after the <Login> tag.
NC-85063	WAF	WAF does not permit file uploads larger than 1 MB in OWA.	Contact Sophos Support.
NC-84972	Web	When you use the web proxy, files that undergo anti-virus scanning are stored in /tmp. If web caching is turned on (Web > General settings > Enable web content cache) the /tmp directory may run out of space. To determine if the issue affects the firewall, enter the following command: df -h /tmp If the availble space shows 0 MB, enter the following command: du -c /tmp/0x1* Non-zero length files can take up a significant portion of the partition. Large numbers of files that are of zero length don't cause the issue.	Do one of the following: Go to Web > General settings, and clear the check box "Enable web content". This option is turned off by default. Restart the firewall.
NC-84550	Reporting	Local reports on Sophos Firewall differ from CFR reports. If the number of bytes transferred exceeds 32 bits, log viewer shows the truncated value.	Will be resolved shortly.
NC-84517	Firewall	Firewall rule isn't applied to terminal server traffic from Server Protection SATC.	The firewall must join the EAP for New Server Protection features and confirm the machine is added to EAP. See details.
NC-84171	L2TP	Multiple clients behind NATed device cause traffic issues. When these try to connect to Sophos Firewall, tunnels are established. However, ping from the first client drops after a few seconds. There's no ping from a client when the other client's ping works.	Will be resolved shortly.
NC-84054	SecuirtyHeartBeat	Configuration migration fails due to invalid byte sequence. Backup isn't restored if there's an error with the database tblappstoeps since it may contain an invalid byte sequence for encoding "UTF8".	Contact Sophos Support.
NC-83527	SecurityHeartbeat	Unable to register Firewall with Sophos Central account because Amazon certificate isn't present in /conf/.	To check if an Amazon certificate is present, enter the following command openssl crl2pkcs7 -nocrl -certfile /conf/certificate/internalcas/cloud-ca.crt \| openssl pkcs7 -print_certs -text -noout \| grep Issuer If Amazon CA isn't present, do as follows: mount -o rw,remount / cp ""/conf/certificate/internalcas/cloud-ca.crt"" ""/conf/certificate/internalcas/cloud-ca.crt.org"" cp ""/_conf/certificate/internalcas/cloud-ca.crt"" ""/conf/certificate/internalcas/cloud-ca.crt"" mount -o remount,ro / These steps don't require downtime.
NC-83108	Config Migration Framework	Upgrading from 18.0.MR6 to 18.5.MR1 results in a factory reset.	Downgrade to the previous firmware and then upgrade to 18.5.MR2. Alternatively, you can upgrade to 18.5.GA and then to 18.5.MR1.
NC-82331	Security Heartbeat	From 18.5 MR2, Sophos Firewall encrypts certificate keys. So, when you upgrade to this version, the firewall refreshes the certificate used by synchronized endpoints to send a Security Heartbeat. If DNS resolution to sophos.com fails, the endpoints may not get the new certificate from Sophos Central, and the heartbeat fails.	Do as follows: Make sure the endpoints have network connectivity during the upgrade. They can then fetch the new certificate from Sophos Central. If the endpoints are blocked from getting DNS resolution for sophos.com to download the new certificate, go to the corresponding firewall rule and temporarily clear the checkbox "Block clients with no heartbeat".
NC-81520	Hotspot	Password isn't printed on the hotspot voucher for bridge to AP LAN and bridge to AP VLAN.	Use a wireless network with Client traffic set to Separate zone instead. Do as follows: Go to Wireless > Wireless networks. Select the network you want and set Client traffic to Separate zone. Go to Hotspots and select the hotspot you want. Set Interfaces to this wireless network.
NC-81039	Licensing	SFOS gets stuck after a restart. On the hardware, hyperthreading was turned on, stopping the kernel from starting. It only happens when SFOS RAM/CPU are lower than that purchased in the license and hyperthreading is turned on on Dell hardware.	Turn off hyperthreading on the server.
NC-73295	IPsec	Child SA (Security Association) disconnects when idle setting is turned on in IPsec remote access.	Under Idle settings, clear the checkbox for Disconnect when tunnel is idle. Create a network rule below the user-based firewall rule. If an active user signs out and user-based rule no longer matches the traffic, the network rule matches, allowing traffic for active networks (child SAs). Then turn the idle setting back on.
NC-73174	Logging framework	Log viewer shows the DDNS events for success and failure twice.	Known behavior
NC-71401	Central Management	Unable to register XG Series firewalls with Central Manager using email addresses with more than 50 characters.	Enter an email address with fewer than 50 characters.
NC-70369	Dynamic routing (OSPF)	Auto-interface cost calculation doesn't work for OSPF.	Go to Routing > OSPF > Override interface configuration. Click Select interface, clear the check box for Interface Cost and enter the cost.
NC-69633	Email	Wildcard SMTP exceptions for FQDN hosts appear on the exceptions list. However, when editing the exception, they aren't visible.	Will be resolved shortly.
NC-69491	Authentication	Unable to access the web admin console after an auto-restart. When a high number of RADIUS SSO users sign in simultaneously and the firewall restarts, sometimes the web admin console isn't available after the restart. However, LAN users can connect, and you can access the firewall through SSH.	Known behavior
NC-69439	Web	For the internet scheme web policy in devices migrating from CROS to SFOS, Policy tester doesn't show the web filter ID.	Known behavior
NC-69088	Unable to create Secure Storage Master Key on HA devices.	On HA devices migrated to 18.0 MR3 or MR4, administrators are unable to create the Secure Storage Master Key.	If you have a configuration backup, reset the firewall to factory configuration. Upgrade to 18.0 MR4 or later version. Restore the backup. Rejoin HA. If you don't want to reset to factory configuration, enter the following advanced shell commands: /bin/nsgenc reset -f /bin/nsgenc init reboot /bin/nsgenc status; echo $? If the result is 1, restore the backup. Upgrade to 18.0 MR4 or later version. Rejoin HA. If the result is 0, contact Sophos Support.
NC-68908	RED	On the web admin console, SD-RED doesn't show LTE support.	SD-RED supports LTE, but incorrectly shows 3G/UMTS failover on the web admin console. Will be resolved shortly.
NC-68438	Web	Web policy rule doesn't support users with the character "/" in the name.	Known behavior
NC-67790	DHCP	DHCP doesn't assign multiple IP addresses to the same MAC address. Example: For the captive portal to work over a bridged interface with a VLAN, the access point creates a virtual interface and needs an IP address from the VLAN. When the captive portal asks for an IP address over VLAN, the discover request comes with the interface's MAC address. If one scope is set to static and the other to dynamic, the IP assignment doesn't work.	Set both the DHCP scopes to dynamic or static.
NC-67688	HA	For 18.0 MR1, when the backup contained redundant information, it increased the backup size. If a larger backup is taken and restored, the /conf may be larger than expected.	Run the following commands on the advanced shell: rm -rf /conf/httpclient/httpclient rm -rf /conf/iview_images/iview_images/ Take a backup again.
NC-65961	Web	Log viewer for Firewall and Web filter shows Allowed for all port 80/443 traffic from WAN to WAN and LAN zones, although users initiating traffic from the WAN zone are shown a block page.	Known behavior
NC-65625	SSL VPN	OpenSSL limits the CN (Common Name) to 64. OpenVPN limits the CN to 63 + 1 (null character). This limits the <username>@<domain name> length to 51 characters since a 12-character random string is added to the CN.	Only use up to 51 characters for <username>@<domain name>.
NC-63913	IPS policy	When XG Series firewall is in FETCH mode in SFM, and users change the Advanced threat setting using the template, the SFM event log shows a failure message.	Known behavior
NC-63535	Email	Modifications aren't allowed to the block email senders list. On Email > General setting > Block senders, when users add a domain or email address, the error "Request could not be completed" appears and the domain or email address isn't added.	Remove any of the domains or email addresses from the block senders list and add them again.
NC-62786	VFP-Firewall	Turning firewall-acceleration on or off bounces the ports.	Will be resolved shortly.
NC-60401	Central Management	When you downgrade the firmware or reset a firewall registered with Sophos Central (and services accepted on Sophos Central), the firewall loses its central registration information. When it's registered again and Central management is turned on, endpoints already known to Sophos Central and the Central Management API consider this a bad request since Central services have already been approved.	Deregister the firewall. For HA devices, deregister both firewalls from Sophos Central. Sign in to Sophos Central., go to Firewall management and click Remove from Central for the firewall. Alternatively, run the following command on the advanced shell: /bin/central-register --register -u <email_of_central_account> -p <password_of_central_account> -s <serialnumber_of_firewall> Once the registration passes, you can deregister the firewall from the Sophos Central console.
NC-60381	Firewall	When heartbeat is set to block endpoints with a red status in the firewall rule configured for a bridge interface, and the firewall blocks the MAC address, it also blocks DHCP requests from the endpoints.	Create a firewall rule with Rule position set to Top and Services set to DHCP. Don't specify the Synchronized Security Heartbeat settings.
NC-60294	Authentication	Users aren't removed immediately from the Live user list when they sign out using the Sophos Network Agent (iOS or Android) although the app disconnects immediately.	Enter the following commands through the advanced shell: echo 0 > /content/caaios echo 0 > /content/caaand restart access_server
NC-59839	Firewall	Email logs for bounced emails may show IP addresses that aren't configured as the source address. Log entries are generated for connection table entries rather than from routing. For conntrack creation, the firewall uses any gateway IP address as the original source address (example: Port4: 10.24.255.254). When routing is done on layer 3, the decision may be to route that connection through Port2, but the original source isn't changed.	Known behavior
NC-59800	Firewall	Creating new firewall rules above the automatic SMTP rule (Email MTA mode) may result in a mail queue on the firewall. The firewall then accepts SMTP traffic but can't deliver the emails to the next hop. Mail queue and time-out errors appear on the /log/smtpd_main.log This can happen with manually configured firewall rules that include SMTP service and automatically created firewall rules (example: with VPN connections).	Place manually created firewall rules for SMTP and automatically created rules below the automatic MTA rule. If mails are already in queue on the firewall, before you reposition the firewall rules, contact Sophos Support for help in using the following script to correct the issue: /scripts/mail/replace_firewall_id.pl.
NC-58684	Firmware management	Upgrade from 17.5.x to 18.0 and later takes about 50 minutes. This is due to the additional checks for file system correction, which take longer based on the hard disk size and status.	Known behavior
NC-56884	Wireless	Built-in wireless stops broadcasting the SSID on 2.4 GHz and 5 GHz intermittently, and users can't see the SSID on their endpoints.	Go to Wireless > Access points, and clear the check box for Dyn Chan. This turns off DCS (Dynamic channel selection) on 5 GHz.
NC-55423	Network services (deprecated)	Difference in data transfer traffic usage between WAN link manager and WAN zone report.	For more information, see Difference between WAN link manager and WAN zone report.
NC-54697	IPS Policy	The show ips-settings command shows only eight firewall rules even when more are configured. The related database entry contains all the firewall rules.	Will be resolved shortly.
NC-54667	Authentication	Sophos Firewall supports up to 3042 simultaneous Corporate Authentication Agent (CAA) connections. When the number of users exceeds the limit, the message "Failed to establish connection! Too many open files" appears in the access server log file. The limit is only for users using CAA. Live user count for other authentication mechanisms aren't part of this limit.	Known behavior
NC-53094	RED	WAN gateway becomes active, causing RED site-to-site tunnels to flap. When you configure multiple WAN gateways, actions that result in the backup gateway or the unused gateway for the RED tunnel to reconnect, cause all RED tunnels to reconnect.	Known behavior
NC-52129	Email	Avira is unable to scan encrypted split files.	Use the Sophos antivirus engine.
NC-51322	Email	Chinese characters in the mail subject don't appear correctly within the quarantine digest email.	Change the encoding used in the end user's mail client to UTF-8.
NC-48871	L2TP	Username with the special character "\" isn't authenticated when signing in with the domain through L2TP.	Will be resolved shortly.
NC-47523	Reporting	Auxiliary HA device sends reports about its own scheduled report.	Known behavior
NC-47092	Firewall	SSH session to a target behind an SFOS firewall appears with delay in the log viewer.	Known behavior
NC-46108	DHCP	DHCP relay configured on an interface with a DHCP server configuration doesn't function.	Expected behavior
NC-44003	SNMP	SNMP query for supportSubStatus and appExpiryDate returns unexpected values.	Known behavior
NC-43682	Email	Mail queue is delayed or fails after update to 17.5. A manual change to disable_offline_relate is lost during a firmware upgrade. Before the upgrade, if you've changed the /static/proxy/smtp/scanner.conf file to set the disable_offline_relate setting to No, the change is lost during a firmware update.	After the firmware upgrade is complete, edit the /static/proxy/smtp/scanner.conf file, and update disable_offline_relate.
NC-42570	WAF, Web	When LAN users want to access a web server deployed in the LAN zone and protected by a WAF rule, these requests don't work. Requests from the LAN zone reach the web server directly without passing the firewall.	WAF rules control traffic for sites hosted on the WAN interface. For internal servers, configure the DNS server to resolve the domain to the backend server directly. Alternatively, to host the site in the LAN zone through WAF, you need a second WAF rule that listens on the internal interface with a different, internal-only domain.
NC-42364	Networking (deprecated)	IPsec route precedence isn't applied. When system route_precedence is configured to give VPN routes higher priority than static routes, the firewall doesn't send the traffic through the IPsec tunnel. Instead, it routes the traffic through a matching static route. This occurs if a static or local route exists directing the traffic to a non-WAN zone. The route precedence command only applies to traffic destined for the WAN zone.	Manually create an IPsec route for the remote subnet. Example: console> system ipsec_route add net 192.168.1.0/255.255.255.0 tunnelname <tunnelname> Then press Tab twice to see the list of available tunnels.
NC-42227	Authentication clients	Currently, Sophos Firewall devices don't support SATC (Sophos Authentication for Thin Client) with Edge browser.	Known behavior
NC-42226	SSL VPN	Locally-signed certificates aren't supported as server certificates in SSL VPN.	Only certificates signed by the local CA are supported. Example: ApplianceCertificate.
NC-38227	RED	Can't turn on RED functionality with DHCP from Network > DHCP.	Go to Interfaces > RED for the RED device. Under RED network settings, turn on DHCP.
NC-35231	ATP framework	Limit of 128 characters to add a threat exception.	Known behavior
NC-35230	Wireless	Can assign only 8 SSIDs or networks to an access point.	Known behavior
NC-33997	Authentication	SSO client installation doesn't work with RDP sessions.	Known behavior
NC-33500	Web	Unable to get the file scanned by Sandstorm. The captive portal shows a cannot reach page. This happens when there's an Any to Any firewall rule with Action set to Drop.	Select a LAN or WAN zone instead of Any zone for the firewall rule with Action set to Drop.
NC-30324	Firewall	Internal hosts can't ping remote access SSL VPN.	Give priority to static routes because SSL VPN routes are static routes. VPN routes represent IPsec routes.
NC-29938	Networking (deprecated)	Static routes won't apply to the system for connected networks, such as RED tunnels. So, you can't use them for route failover for these networks.	Use SD-WAN routes for route failover.
NC-29517	Date and time zone	Time zone is different on the web admin and CLI consoles.	Copy the content from /etc/zoneinfo/<timezone> to /conf/TZ. Then restart the firewall.
NC-27906	Email	In legacy mode, when you turn on greylisting on the server, emails are rejected because legacy Mode doesn't support retrying of emails. Failed emails are rejected with the following log message: 451 Temporary local problem, please try again!	For more information, see How to work around the issue when legacy mode doesn't support email retry.
NC-27452	WAF	No support for Microsoft RDG protocol suite.	WAF only supports RPC_IN_DATA and RPC_OUT_DATA. These are the only types supported when Pass Outlook Anywhere is turned on.
NC-26865	Wireless	Link/Activity LED glows on Port3 and Port4 even when the ports are disabed in XG 85(w), XG 125(w), and XG 135(w).	Known behavior
NC-25733	IPsec	Can't see custom IPsec profiles that use a preshared key with aggressive mode after upgrading to 17.0 MR1 although the profile is in use in an IPsec connection.	The firewall doesn't support preshared keys in aggressive mode. It only supports aggressive mode with RSA key and digital certificate.
NC-22697	Web	Citrix-based web application isn't working with Allow all web policy. In transparent mode, Citrix clients aren't aware that there's an HTTP or HTTPS proxy in the middle. So, they start using a proprietary protocol (not HTTP or HTTPS) using the HTTP and HTTPS ports. The proxy doesn't understand this and waits for a client request while the Citrix client waits for the server to respond. So, launching a .ica file with Citrix web or application fails.	You need to punch a hole in the firewall. Do as follows: For traffic from the LAN zone to the destination IP addresses of your URL in the WAN zone to launch the .ica file, create a LAN to WAN firewall rule with web policy set to None. Then create a firewall rule with web policy set to Allow all from LAN to WAN.
NC-22372	Email	Missing prefix subject with IMAP and many email clients. With IMAP, some mail clients download only the root headers from the server. They download the complete email only when users click the email subject. Sophos Firewall doesn't scan headers for spam since headers don't have enough information to detect spam. The IMAP proxy scans emails for spam only when the mail client downloads the complete email. The firewall then scans and adds a prefix to the subject for spam. So, the spam prefix doesn't appear in the email client's folder view.	Known behavior
NC-22206	Clientless access (HTTP and HTTPS)	Bookmarks of websites that require NTLM authentication don't work with clientless authentication.	Sophos Firewall doesn't support NTLM authentication with clientless web access.
NC-19628	Authentication	Sophos Firewall doesn't support browsing on IE11 in protective mode with SATC authentication.	Known behavior
NC-19479	Clientless access (HTTP and HTTPS)	Can't access websites that require the destination domain in the URL host through clientless access. Example: CNN.com.	Known behavior
NC-19478	Clientless access (HTTP and HTTPS)	Can't access websites with UTF-16 characters in the URL using bookmarks. Clientless access needs HTML links to be rewritten within the response document to ensure that links work for users outside the proxy. The firewall doesn't rewrite URLs with UTF-16 encoded special characters. So, these sites won't open through clientless access. Example: http:\u002f\u002fportal.example.com	Known behavior
NC-19476	Clientless access (HTTP and HTTPS)	Can't access web servers containing JavaScript-based dynamically generated URLs through HTTP and HTTPS bookmarks.	Known behavior
NC-18385	WAF	After successful form-based authentication, users are redirected to the defined path in the corresponding site path routing profile rather than to the original requested path.	Known behavior
NC-17808	Email	Wrong decoding if a policy with Change prefix subject is configured with umlaut characters.	Known behavior
NC-17457	Networking (deprecated)	Username for PPPoE interfaces is limited to 50 characters.	Insert a dummy username using less than 50 characters on the web admin console for the PPPoE interface. Go to the advanced shell and enter the following: psql -U nobody -d corporate Go to the corporate DB and enter the following: corporate> update tblpppoeconf set "user"='john.doe@example.com' Now disconnect the PPPoE connection and reconnect to bring the changes into effect.
NC-16462	Reporting	When generating a custom report, only the results appearing on the current page are exported to HTML, PDF, and CSV formats. The full list isn't exported.	Known behavior
NC-14880	Web	Safe search is enforced on all the policies without exception.	Known behavior
NC-13946	Authentication	STAS users with special characters (',/") in the name don't appear.	Sophos Firewall doesn't support usernames with these special characters.
NC-13934	Reporting	Auxiliary device sends only a few configured scheduled reports.	If reports don't contain data in auxiliary devices, report notifications aren't sent.
NC-13659	Security Heartbeat	Host information for blocked sources is shown on ATP flipside but isn't updated.	Manually reopen the flipside to see the change in host status. Example: Green, red, missing
NC-13639	Captive portal	Local users with names containing umlaut characters (example: ööööööö) can't sign in. They can sign in through AD and STAS. Unable to create local users with special characters (UTF-8). Existing AD users with such names can't sign in.	Known behavior
NC-13637	Routing (deprecated)	Route precedence isn't followed for policy-based routing in RED site-to-site tunnels.	Known behavior
NC-13636	VPN (deprecated)	Can't create L2TP connection with preshared key for mobile phones.	Known behavior
NC-13632	RED	Unable to do offline provisioning of RED 50 device using USB device.	Do online provisioning centrally. REDs are then upgraded to the latest firmware. You can then perform offline provisioning.
NC-13618	Clientless access (HTTP and HTTPS)	Unable to access the web admin console of a firewall by using bookmarks from the same firewall.	Known behavior
NC-13598	Firewall	10G SFP+ network cards on software appliances aren't recognized.	Known behavior
NC-9641	WAF	Outlook Anywhere doesn't work when Common threat filter is turned on in the web server protection policy.	RPC (Remote Procedural Call) doesn't work when Common threat filter is on. CTF checks the validity of HTTP requests and responses and compliance with HTTP standards and common practices. MS_RPC, the protocol underlying some of MS Outlook’s Anywhere feature doesn't meet all these rules and common practices. Turn off Common threat filter in the web server protection policy.
NC-9132	WAF	Websockets aren't supported for WAF.	Known behavior
NC-9124	Firewall	STAS isn't working when AD servers are only reachable on WAN.	Known behavior
NC-9106	Framework part of base (deprecated)	Mail notification isn't working with Microsoft Office365.	Sophos Firewall supports STARTTLS and SSL/TLS to encrypt emails. However, for SMTP, it only supports PLAIN authentication, which Office 365 doesn't support. Configure an intermediate relay to workaround this behavior.
NC-9102	Hotspot	Custom logo doesn't appear on the hotspot sign-in page if the hotspot name contains whitespace.	Don't use white spaces in hotspot names.
NC-9063	Firewall	Unable to create a hotspot through SFM with an HTML filename that has a space.	Don't use spaces in filenames.
NC-8891	VPN	CHAP and CHAPV2 in L2TP and PPTP VPN with AD configuration isn't working.	Use PAP as authentication method.
NC-8888	VPN (deprecated)	IPsec (site-to-site) between SFOS and SonicWall isn't working in aggressive mode.	Use main mode.
NC-43145	Hardware	HA pair becomes unstable if you use the shared port as the dedicated link on XG 106	Don't use the shared port (Port 4) for the HA dedicated link.
NC-43721	Hardware	Half-duplex isn't working on the upper four ports of XG 125 and XG 135 Rev.3	Use ports 5, 6, 7, or 8 with half-duplex.
NC-76186	Hardware-XG Series	4X10G Flexiport module with the Intel 700 series NVM data and driver isn't recognized.	Known behavior
NC-55068	Hardware	XG 115 Rev.3 models show no HDMI output unless a monitor is connected before the device starts.	Known behavior
NC-53886	Hardware-SG and XG Series	40Gbit QSFP+ Flexiport module isn't recognized on SG/XG 430/450 firewalls.	Known behavior

Supported platforms

SFOS 18.0 is supported on all XG and SG appliances with at least 4 GB of RAM.

With the new Xstream packet processing architecture, you will enjoy a nice performance boost on your existing hardware.

SFOS 18.0 won't be supported on older XG 85/105 and SG 105 models that have 2 GB of RAM but will run perfectly on the newer XG 86/106 models that have 4 GB of RAM.

Cyberoam appliances don't support SFOS 18.0. Models that don’t support version 18 will continue to be supported for the foreseeable future on version 17.5. However, you can restore Cyberoam firewall backups on XG Firewall operating on 18.0.

Supported firmware versions

18.0 GA and later support Wi-Fi firmware 11.0.019 and earlier.

18.0 MR3 and later support RED firmware 3.0.007 and earlier.

Upgrading to SFOS 18.0.6

You can upgrade from SFOS 17.5 (MR6 to MR16) and all SFOS 18.0 versions to 18.0 MR6 (build 655) and restore configuration backups.

Migration versions

We strongly recommend that you migrate only to the approved versions listed in the following table. If you try to migrate to other versions, Sophos Firewall shows an alert asking you to confirm the migration before it restarts. If you confirm the migration, Sophos Firewall restarts with the factory configuration, and you lose your current configuration.

You cannot upgrade from SFOS 18.0 MR6 to SFOS 18.5 MR1.

Supported migration from 17.5 to 18.0
Migrate from 17.5	Migrate to 18.0
	MR1 (build 396)	MR2	MR3	MR4	MR5 (builds 574 and 586)	MR6
17.5 MR6 to MR12	Yes	Yes	Yes	Yes	Yes	Yes
17.5 MR13 17.5 MR14 17.5 MR14.1	No	No	Yes	Yes	Yes	Yes
17.5 MR15	No	No	No	Yes	Yes	Yes
17.5 MR16	No	No	No	No	Yes	Yes

Restrictions

18.0 and later versions require a minimum of 4 GB RAM. So, you can't upgrade the following models to 18.0 and later:

XG 85, XG 85w, XG 105, and XG 105w
SG 105, SG 105w

These models must remain on a 17.x version. See XG Firewall Lifecycle Policy and XG Firewall retirement calendar.

Cyberoam models don't support 18.0 and later firmware versions. However, you can restore Cyberoam firewall backups on XG Firewall operating on 18.0 and later.

Support for RED devices

The support details of XG Firewall for RED devices are as follows:

Doesn't support RED 10 devices.
Supports RED 15, RED 15w, and RED 50 devices.
Supports SD-RED 20 and SD-RED 60 devices.

Firmware

If your XG Firewall is on 18.0 MR3 or later, you can schedule firmware upgrades from Sophos Central.

Rollback (firmware switch) is supported. You can roll back to 17.5 MRx if you experience any issues with 18.0 and later. For example, the active firmware on the firewall is 18.0 and the other firmware version is 17.5. You can switch between these two versions. This doesn't change the configuration on either.

You can't downgrade from 18.0 and later to an older firmware using 17.5 or an earlier firmware file. The web admin console will show an alert.

18.0 and later use Grub boot loader. The changed bootloader can't recognize 17.x firmware. You can still use the hardware ISO of 17.5 or earlier to have the firewall on an older firmware version and restore the downgraded firmware's backup.

In 18.0, we moved to a more secure firmware signing method. The firmware update files now use the .sig extension and not the earlier .gpg extension.

The web admin console shows the specific reasons for firmware upload failure.

Backup and restore are supported. You can restore backups from the following on 18.0 and later versions:

SG firewalls running SFOS
Cyberoam firewalls
XG Firewall backups

HA

SFOS 18.0 moved to SSH tunnel-based secure communication for the HA cluster. If you're upgrading the HA cluster to 18.0 or later for the first time, both the devices in the cluster will restart simultaneously once. You'll receive an alert on the UI before you can proceed.

Support

You can find technical support for Sophos products in any of these ways:

Visit the Sophos Community at Sophos Community and search for other users who are experiencing the same problem.
Visit Sophos support at Sophos Support.
Find how-to, configuration and troubleshooting videos at Sophos Techvids video hub.

Legal notices

Copyright © 2021 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

Sophos Firewall

Version 18.0 MR6 Build 655 Released on September 08, 2021

Enhancements

Version 18.0 MR5 Build 585 Released on April 29, 2021

New features

SD-WAN: Azure secure SD-WAN integration with XG Firewall

Authentication: Azure AD integration with XG Firewall

Certificate signing requests (CSRs) and certificates

Synchronized Security

Remote Network Devices (REDs)

Central reporting

Version 18.0 MR4 Build 506 Released on December 15, 2020

New features

Sophos Cloud Optix

Amazon Web Services

Sophos Central

High availability

Sophos Connect client

Web

RADIUS server

Synchronized Application Control

Enhancements

Version 18.0 MR3 Build 457 Released on October 13, 2020

New features

Secure storage master key Enhanced security

High availability Enhanced security

Access to some services Enhanced security

CAPTCHA Enhanced security

Users Enhanced security

Other new features and enhancements

SSL VPN concurrent tunnels

Sophos Connect client

Nutanix

AWS

Zones for custom gateways

Sophos Central Firewall Management

Sophos Central Firewall reporting (CFR)

RED 10

Version 18.0 MR2 Build 403 Released on July 23, 2020

Version 18.0 MR1 Build 396

New features

Security hotfixes

RED devices

Quarantined emails

Version 18.0 Build 379 Released on April 30, 2020

New features

Xstream architecture

Sandstorm threat intelligence analysis

Sophos Central Firewall Reporting and Management

NAT Enhancements

Improvements in managing firewall rules

Wild card domains in WAF rules

SD-WAN policy-based routing

Enhanced High Availability

Alerts and Notifications

Intelligent IPS signature selection

DKIM and BATV anti-spam protection

Kerberos authentication and NTLM

RADIUS time-out with two-factor authentication (2FA)

Bridge-VLAN support

SNMPv3

Route-based VPN

Web policy quota

Enhancements

Resolved issues

Version 18.0 MR6 Build 655

Version 18.0 MR5 Build 586

Version 18.0 MR4 Build 506

Version 18.0 MR3 Build 457

Version 18.0 MR1 Build 396

Version 18.0 Build 379

Version 18.0 Build 354

Version 18.0 Build 339

Version 18.0 Build 321

Known issues

Supported platforms

Supported firmware versions

Upgrading to SFOS 18.0.6

Migration versions

Restrictions

Version 18.0 MR6 Build 655
Released on September 08, 2021

Version 18.0 MR5 Build 585
Released on April 29, 2021

Version 18.0 MR4 Build 506
Released on December 15, 2020

Version 18.0 MR3 Build 457
Released on October 13, 2020

Version 18.0 MR2 Build 403
Released on July 23, 2020

Version 18.0 Build 379
Released on April 30, 2020