XG Firewall

These are the release notes for XG Firewall.

View the product documentation at XG Firewall help.

Version 18.0 MR5 Build 586

New features

This section contains the new features for 18.0 MR5.

VPN

SSL VPN and WAF ports: SSL VPN traffic won’t flow through the hosted IP addresses configured for WAF rules if it shares the same port and protocol (example: TCP port 443) with WAF. For more information, see VPN settings.
Concurrent IPsec tunnels: Introduced more than 50 per cent increase in concurrent IPsec VPN tunnels across all hardware appliances. For more information, see the Advisory.
IPsec provisioning file: Provided provisioning file support for IPsec remote access VPNs. Users must install version 2.1 of the Sophos Connect client.

SD-WAN: Azure secure SD-WAN integration with XG Firewall

Published article: How to integrate XG Firewall with Azure Virtual WAN (secure SD-WAN)

Authentication: Azure AD integration with XG Firewall

Published article: How to integrate XG Firewall with Azure AD

Certificate signing requests (CSRs) and certificates

Streamlined forms and multiple SANs: Updated the forms for creating CSRs and certificates to allow more flexibility in adding Subject Alternative Names using DNS names and IP addresses, and removed unnecessary inputs.
Security enhancements: Addressed security concerns by preventing the download of private key material for CSRs and locally-signed certificates.
Upload, download, import: Provided new dialog boxes to allow CSR retrieval, and certificate upload for signing certificates (CAs) and leaf certificates. The boxes allow you to copy-paste PEM format certificates in addition to the DER, PKCS and PEM file transfer.
Locally-signed certificates: Self-signed certificates have been renamed locally-signed certificates.
Download format: CSRs and certificates can be downloaded as .csr and .crt files, respectively. They can't be downloaded as tar.gz files any longer.
Certificate with CA: Provided the option to add the certificate's CA to the CA list, using the same name when importing certificates with CA.
Workflow: Improvements to workflows and lists to make certificate management more intuitive.

Synchronized Security

Sophos Central registration for HA devices: Improved handling of Sophos Central registration and seamless deregistration process.
Notifications for missing heartbeats: Provided system commands on the CLI to delay or suppress notifications about endpoints going into missing heartbeat status after intentional actions, such as shutdown, restart, sleep, hibernate, and network switching. For more information, see the CLI help.

Remote Network Devices (REDs)

Removed RED 10 from the configuration options. These are end-of-life devices which haven't been supported since 18.0 MR3.
The firewall no longer supports the currently configured RED 10 tunnels. A warning to this effect will appear on the UI.

Central reporting

Released the CASB report and MSP Flex licensing on Central Firewall reporting.

Version 18.0 MR4 Build 506

New features

This section contains the new features for 18.0 MR4.

Sophos Cloud Optix

For XG Firewall instances deployed in the AWS environment, you can see their VPC details in the topology section in Sophos Cloud Optix. For more details, see Cloud Optix help.

Amazon Web Services

Routing-based redundancy enhancements are available on the AWS platform.

Sophos Central

You can register HA devices with Sophos Central and manage them centrally. Both devices must be on 18.0 MR4. You must configure HA on the web admin console of XG Firewall.

High availability

Improvements to FastPath offload for HA active-passive configurations.

Sophos Connect client

The Sophos Connect client menu has been renamed IPsec (remote access). It's available on VPN > IPsec (remote access). You can configure the IPsec remote access configuration on this page. It also offers the advanced settings that were earlier available only through Sophos Connect Admin.

Turning off "Use as default gateway" on the web admin console may prevent connections from being established if the existing configuration files don't match the advanced settings. If you make changes to any of the advanced settings on the web admin console, you must send the updated .scx file to users for reimport into the Sophos Connect client.

Users can download the Sophos Connect client from VPN > Sophos Connect client (IPsec and SSL VPN) on the user portal. The available client versions and the remote access connections users can establish are as follows:

Windows: Sophos Connect client 2.0 (IPsec and SSL VPN connections).
macOS: Sophos Connect client 1.4 (Currently, only IPsec connections).

For more information, see remote access VPN help.

Web

XG Firewall blocks web pages categorized as highly objectionable criminal activity and hides the domain name in logs and reports. It won't implement any policy or exclusion that allows these pages.

RADIUS server

An optional Domain name field, which creates a local entry in the format user@domainname for RADIUS users, is available. The setting eliminates the issue of two entries being created automatically when authentication is based on both AD and RADIUS servers, for example, when the primary authentication method is AD, but VPN or multi-factor authentication uses RADIUS.

Synchronized Application Control

You can also set the automatic cleanup time to one month.

Enhancements

This section describes the security enhancements introduced in XG Firewall 18.0 MR4.

SSL VPN: XG Firewall enforces TLS 1.2 for SSL VPN connections.

Site-to-site connections: Both SSL VPN server and client firewalls must be on 18.0 MR4.
Remote access connections: These connections use OpenVPN client 2.3.8 and later. The Sophos Connect client 2.0 and legacy SSL VPN client enforce TLS 1.2.

Password security: Introduced a secure hash for storing the password of the admin (default administrator) account. The control center prompts the default administrator to change the current password. We recommend making this change. It's a one-time requirement.

Password complexity is turned on by default for all passwords, including those for the web admin console and the user portal.

Open SSL: XG Firewall now uses OpenSSL 1.0.2u.

SPX portal: A CAPTCHA is now required for the SPX portal to prevent automated attacks. You can't turn it off.

Version 18.0 MR3 Build 457

New features

We introduced stronger protection for sensitive information and enhanced security.

Secure storage master key Enhanced security

We introduced a secure storage master key to provide extra protection for the account details stored on XG Firewall. The key encrypts sensitive information, such as passwords, secrets, and keys, preventing unauthorized access.

You must set the master key and store it in a secure location. If you lose it, you can't recover it. It has implications for backup-restore and import-export. For more details, see the support article.

High availability Enhanced security

The firewall now uses SHA256 encryption for your HA passphrase.

Access to some services Enhanced security

We recommend that you do not allow access to the XG Firewall consoles, user portal, and some services over the WAN zone. If you allow access from the WAN zone to the following services, warnings appear on the Administration > Device access page:

HTTPS (web admin console)
SSH (CLI)
Ping/Ping6
DNS: This applies when XG Firewall acts as the DNS server.
User portal

CAPTCHA Enhanced security

You can turn off the CAPTCHA from the CLI for the web admin console and the user portal. You can turn it off for only the VPN zone, or both VPN and WAN zones. Use the following syntax to enter the commands:

console> system captcha-authentication-global [enable] [disable] [show]

Selecting the consoles: [userportal] [webadminconsole]

console> system captcha-authentication-vpn [enable] [disable] [show]

Selecting the consoles: [userportal] [webadminconsole]

console> system captcha-authentication-global [enable] [disable] [show]

Users Enhanced security

You can't export or import local users from Authentication > Users any longer.

Other new features and enhancements

SSL VPN concurrent tunnels

XG Firewall now supports a larger number of concurrent SSL VPN tunnels. For more details, see SSL VPN concurrent tunnels.

Sophos Connect client

You can import groups from LDAP, AD, and other directories. XG Firewall allows access for users who belong to the groups based on the assigned policy.

Users who belong to these groups must sign in to the user portal. The sign-in adds these users to XG Firewall. XG Firewall can then authenticate the users and allow them to access the VPN connection.

Nutanix

XG Firewall is now available over the Nutanix AHV and Nutanix Flow infrastructure. XG Firewall secures traffic using the following two modes of operation:

Next-generation firewall protection for Nutanix infrastructure using route mode.
East-west protection for individual virtual machines and applications with Nutanix Flow micro-segmentation using non-IP bridge mode.

AWS

XG Firewall also supports C5, M5, and T3 instances. The firewall now supports CloudFormation Templates, eliminating the need to run the installation wizard in some instances.

Zones for custom gateways

You can assign any zone to a custom gateway.

You can create a virtual WAN zone on custom gateways for single arm usage after deployment. On single arm (a single interface in AWS or Azure), you can create more than one custom gateway and attach different zones to these gateways. You can then create access and security rules for traffic going to these zones.

XG Firewall doesn't allow the following actions:

You can't set the zone for the default gateway.
Custom gateways don't participate in load balancing even for the WAN zone.
XG Firewall doesn't apply the custom gateway zone if a migrated policy route applies to the traffic. These are policy routes migrated to 18.0 from earlier versions.
XG Firewall doesn't perform VPN lookups when the WAN zone is marked through a gateway.

Sophos Central Firewall Management

You can use Sophos Central to manage XG Firewall devices running in active-active and active-passive HA configurations. You can also use the functionality with the earlier 18.0 versions.

Sophos Central Firewall reporting (CFR)

Customers of CFR Advanced can save, schedule, export, and download reports from Sophos Central.

RED 10

You can't add RED 10 devices to XG Firewall any longer. The devices already in use will continue to work but without support.

Version 18.0 MR2

SFOS 18.0 MR2 is an interim release limited to offering early access to IPS engine version upgrade and related changes. We’ll make a broader release with new features and resolved issues shortly.

Version 18.0 MR1 Build 396

New features

Security hotfixes

The security hotfixes released until now are part of SFOS 18.0.1 MR1 (build 396). The hotfixes referred to in Fixing SQL injection vulnerability and malicious code execution in XG Firewall/SFOS, HF051220.1 and HF052220.1, are not required for this release.

RED devices

This version supports SD-RED 20 and 60 devices.

Quarantined emails

You can only release quarantined emails from the user portal. For details, see How to release quarantined email from quarantine spam digest email.

Version 18.0

New features

This describes the new features introduced in XG Firewall 18.0.

For detailed information on XG Firewall, go to the online help.

For an overview of the key features, please read What’s New in v18.

Xstream architecture

We are introducing the new Xstream architecture for XG Firewall - A new streaming packet processing architecture that provides extreme levels of protection and performance. The new architecture includes:

Xstream SSL inspection: Enable SSL inspection on your network without compromising network performance or the user experience. It delivers high-performance, high-connection-capacity support for TLS 1.3 and all modern cipher suites providing extreme SSL inspection performance across all ports, protocols, and applications. It also comes equipped with enterprise-grade controls to optimize security, privacy, and performance.
Xstream DPI engine: Enables comprehensive threat protection in a single high-performance streaming DPI engine with proxyless scanning of all traffic for AV, IPS, and web threats as well as providing application control and SSL inspection.
Xstream network flow FastPath: Provides the ultimate in performance by intelligently offloading traffic processing to transfer trusted traffic at wire speeds. FastPath offloading can be controlled through policy to accelerate important cloud application traffic or intelligently by the DPI engine based on traffic characteristics.

Sandstorm threat intelligence analysis

Sophos Sandstorm gains an added layer of artificial intelligence protection. All suspicious files are now subject to threat intelligence analysis in parallel with full sandbox analysis. Files are checked against the Sophos Labs threat intelligence database and subjected to our industry-leading deep learning. This identifies new and unknown malware quickly and efficiently, often rendering a verdict in seconds, to stop the latest zero-day threats before they get on the network.

Sophos Central Firewall Reporting and Management

This release includes support for new firewall reporting and management capabilities being launched simultaneously on Sophos Central including a rich powerful new reporting suite and group firewall management tools. To register with Sophos Central, go to Central synchronization.

NAT Enhancements

XG Firewall’s NAT configuration receives a major update as NAT rules are now decoupled from Firewall Rules enabling more powerful and flexible configuration options including Source (SNAT) and Destination (DNAT) in a single rule. NAT Rules can still be “snapped-in” to a Firewall Rule and edited in-place similar to other snap-in policies such as IPS and Web policies.

Improvements in managing firewall rules

Firewall rule management includes a new Add filter option with several fields and conditions to choose from. Adding a filter makes it easier to find firewall rules based on the selected filter criteria. Once selected, filters stay selected even when you move to other configuration screens.

You can manage multiple firewall rules at the same time (for example, select multiple rules to delete, enable or disable, attach to a group). Movement of rules across screens is possible, providing ease of use and management for larger rule sets.

Within the firewall rule there is an exclusion feature that provides a “negate” option in the matching criteria to reduce the management and ordering overhead of multiple rules. There’s also a UI option to reset the data transfer counter for a firewall rule to improve troubleshooting.

Wild card domains in WAF rules

You can now add wildcard domains in WAF (Web Application Firewall) rules. You can add wildcard subdomains (example: *.example.com) for both HTTP and HTTPS connections.

SD-WAN policy-based routing

Policy-based routing gains added SD-WAN flexibility and more granular control with the addition of application, user and group-based traffic selection criteria. Routing can be defined through either the primary or a backup gateway WAN connection and can be configured for replay direction.

Enhanced High Availability

You can now update more high availability settings without breaking HA and can also use the new QuickHA configuration mode.

Alerts and Notifications

There is a new option to choose from dozens of system and threat-related alerts and have notifications sent via email or SNMP.

Intelligent IPS signature selection

XG Firewall receives IPS signatures based on a number of intelligent filtering criteria, such as age, vendor, vulnerability type, and CVSS (Common Vulnerability Scoring System) to optimize protection and performance.

DKIM and BATV anti-spam protection

Anti-spam protection is improved with support for DomainKeys Identified Mail (DKIM). It detects forged sender addresses and Bounce Address Tag Validation (BATV) to determine whether the bounce address specified in the received email is valid and reject backscatter spam.

Kerberos authentication and NTLM

This release adds Kerberos authentication alongside the existing NTLM support for Microsoft Active Directory SSO, extending the range of authentication tools available for customers.

RADIUS time-out with two-factor authentication (2FA)

For customers using two-factor authentication (2FA) with RADIUS server authentication, the timeout value is now configurable allowing additional time to finish the authentication flow when necessary.

You can use the two-factor authentication (one-time password) for administrator access, user portal, IPsec and SSL VPN.

Bridge-VLAN support

VLANs are now supported on bridge interfaces, enabling greater networking flexibility and support for advanced inter-VLAN routing and bridging deployments.

SNMPv3

Support for SNMPv3 is added, providing more flexibility and security over SNMPv2.

SNMP (Simple Network Management Protocol) gives access to XG Firewall information, for example, status of the firewall, service availability, CPU, memory, and disk usage. XG Firewall now supports SNMPv3 users in addition to SNMPv1 and SNMPv2c protocols, ensuring confidentiality, message integrity, and validity of the user.

Route-based VPN

You can now create IPsec VPN connections that use tunnel interfaces as endpoints, making static and dynamic routing possible.

Web policy quota

Browsing quotas have been added to web policies, allowing you to set time quotas for browsing selected website categories. Users can choose how and when to consume their daily time quota.

Enhancements

This describes the enhancements introduced in XG Firewall 18.0.

Interface renaming: Interfaces can be renamed making networking configuration easier and more intuitive.
Jumbo Frame Support: Jumbo frames with more than 1500 byte payloads are now supported for added networking flexibility in high bandwidth environments.
Enhanced DDNS support: Provides support for enhanced HTTPS-based DDNS by adding five more DDNS providers: No-IP, DNS-O-Static, Google DNS, Namecheap, and FreeDNS.
Improved Synchronized Application Control verdict: If there is a pattern-based match conflict, Synchronized Application Control verdict is used. This gives more accurate application control.
DHCP relay enhancements for dynamic routing: Synchronizes dynamic routing updates (learned routes from OSPF) to DHCP relay, eliminating the need for manual reconfiguration.
Secure Syslog and logs in the standard Syslog format: Provides the option to fetch logs in the standard syslog format using secure TLS.
Dynamic GeoIP (IP to country mapping) database: The GeoIP database is now updated dynamically in real time from the Up2Date servers. Make sure you always use the appropriate country-specific filters and policies.
VMware Tools upgrade and integration with VMware Site Recovery Manager (SRM): Supports virtual device integration of the latest VMware Tools version (v10.3.10) with reboot, shutdown, and clone-like functionalities. The release also supports integration with Site Recovery Manager (SRM), the disaster recovery and business continuity solution from VMware which automates the transfer of virtual machines to a local or remote recovery site.
Log viewer enhancements: The log viewer gets several enhancements with one-click actions available right from the logs to narrow search results, filter log entries, or create or modify policies on the fly.
New filter and search options, including the choice to disable signatures, block a source IP address, edit interfaces, and modify IPS, app control, or web filtering policies.
Live Connections: The live connections pages for IPv4 and IPv6 provide a lot of new insights into concurrent traffic in your network.
Access points can be restarted from the web admin console: You can now restart wireless access points from the web admin console. To restart an access point, select an access point and click Restart.
Sophos Connect address range: Sophos Connect lease now supports more than 255 IP addresses in the address range. XG Firewall now supports class B networks for IP addresses leased to the Sophos Connect client. You can change the last two octets.

Resolved issues

Version 18.0 MR5 Build 586

Resolved issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-71491	SNMP	Migration issue when two SNMP communities are configured with the same source IP address.
NC-71456	Sophos Connect client	Unable to download the Sophos Connect Client from user portal for macOS and Windows.
NC-71582	Sophos Connect client	Connection failure when the preshared key length is 128 or more characters.
NC-72172	VPN	Preshared key for IPsec remote access and L2TP shows the encrypted value.
NC-65239	Authentication	SATC users not authenticated sporadically.
NC-62902	Authentication, Backup-restore	Unable to upload backup from 17.5 MR12 to 17.5 MR14.
NC-66124	Bridge	VLAN of bridge interface doesn't follow the ZoneID for device access.
NC-68732	Central management	XG86W_AM01 firewalls are unable to apply configurations received from Sophos Central.
NC-69835	Central management	Unable to import configuration from XG86W.
NC-69683	CROS to SFOS migration	Migration issues from CR to XG Firewall.
NC-60180	CSC	Overrides the specified schedule after failover in active-passive.
NC-67759	Diagnostics	System graph: In Japanese language, memory usage for one month shows one week in the heading.
NC-67605	Email	Unable to turn on DKIM verification.
NC-65346	Email	Unable to see DKIM verification emails on the quarantine page in user portal even with the default setting.
NC-63436	Email	Legacy mode: Unable to delete spam check exception.
NC-51915	Email	Selecting a certificate isn't mandatory in notification settings even when SSL/TLS is selected.
NC-66977	Firewall	Couldn't unload SIP helper in HA mode.
NC-64917	Firewall	Firewall restarts with bridge deployment in HA mode.
NC-64820	Firewall	Awarrenhttp proxy blocks inbound connections on port 443.
NC-63772	Firewall	Policy test for firewall rule doesn't show correct results.
NC-63612	Firewall	Firewall restarts when load balancing DNAT traffic with an FQDN (dynamic IP addresses).
NC-67274	HA	Unable to disable HA when there's an SSL/TLS rule specifying source and destination zones.
NC-66978	HA	HA page doesn't respond after turning on QuickHA.
NC-53059	HA	HA active-active load balancing interrupts remote printing.
NC-70928	IPS, DAQ, NSE	Certificate request message isn't passed to client when SSL/TLS rules apply.
NC-66682	IPS engine	After migration from version 17.5 to 18.0, IPS Logs for WAF show the LAN interface IP address as the source IP address instead of the public IP address.
NC-55213	IPsec	IPsec tunnel up or down: Several email notifications are sent when the connection is terminated.
NC-64309	Network utilities	When ping is set to IPv6, it switches to IPv4 on the web admin console, but IPv6 interfaces are shown.
NC-59619	Policy routing	Unable to create policy route when Name has an apostrophe (').
NC-69693	RED	All RED 50 devices disconnect repeatedly.
NC-68724	RED	Changing the configuration on a RED interface disconnects all RED interfaces.
NC-63136	RED	Configuration change on one RED tunnel causes all other RED tunnels to reset.
NC-64045	RED	If RED is configured, the firewall must not allow transparent-split or 3G failover configuration.
NC-64010	RED	Confirmation message states beta firmware instead of unified firmware.
NC-63179	RED	RED interfaces show they are connected to an incorrect IP address.
NC-70742	Reporting	In HA, the newly active XG Firewall device couldn't update information on Sophos Central after changing from passive to active device.
NC-66437	Reporting	No user reporting statistics after firmware upgrade.
NC-66024	Reporting	Blocked web report doesn't appear for October 2020.
NC-65522	Reporting	Time filter shows blank or inaccurrate output in log viewer.
NC-60391	Reporting	Custom logo stretches in executive reports from the 2nd page onwards.
NC-65148	SNMP	SNMP shows incorrect license details.
NC-64908	SSL VPN	SSL VPN disconnects, but status shows it's connected.
NC-64773	SSLVPN	Packet loss and latency occur on SSL VPN when the tunnel connects or disconnects in version 18.0 MR3.
NC-67364	Static routing	Country blocking through firewall rule doesn't work.
NC-67178	Static routing	Country blocking rule blocks URLs.
NC-62682	Static routing	Netherlands appears in two country groups.
NC-62259	Synchronized Application Control	SAC menu doesn't load.
NC-66616	UI framework	Sometimes the web admin console and user portal pages don't load due to a memory issue.
NC-67365	UI framework	Administrator user is unable to sign in to the user portal when the login disclaimer is on in version 18.5 MR4.
NC-64984	UI framework	Page load issue when refreshing the packet capture page with wrap buffer on.
NC-64758	UI framework	Users are signed out of the user portal when they click Install under Configuration for IPsec VPN client for Apple iOS.
NC-60856	UI framework	False positive reported in third-party scan.
NC-57742	WAF	Incorrect WAF rule ID resolution in syslog.log.
NC-63996	WebInSnort	Delay in connecting to an SSL/TLS-protected FTP server.
NC-66028	WWAN	USB doesn't connect after an upgrade from version 17.5 MR12 to 17.5 MR14 or 18.0.
NRF-447	RED	Unable to connect RED 20 to XG Firewall.
NAF-33	Access Point, Firmware	Wireless devices disconnect intermittently when they connect to SSIDs containing special characters.
NAF-19	Access Point, Firmware	Corruption of calibration data on AP15.

Version 18.0 MR4 Build 506

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-59149	API framework	CSC stops responding since all 16 workers remain busy.
NC-50703	Authentication	Access server restarted with coredump using STAS and Chrome SSO.
NC-54576	Authentication	Sophos Connect client connections exhaust the virtual IP pool.
NC-57273	Authentication	Need to create users for RADIUS in UPN format.
NC-59129	Authentication	Authentication fails due to SSL VPN (MAC BINDING). Logging doesn't carry any information for the cause.
NC-61017	AWS	AWS: TX-DRP increases constantly and affects production traffic.
NC-59574	Base System (deprecated)	Sometimes hotfix timer is deleted.
NC-58587	Clientless Access	Clientless access service crashes.
NC-59411	DNS	Unable to add underscore character in DNS host entry.
NC-54604	Email	POPs/IMAPs (warren) dropping connection due to SSL cache error.
NC-59897	Email	Specific inbound mail not being scanned for malware.
NC-60858	Email	PDF attachment in inbound email got stripped by email protection.
NC-63870	Email	Firewall creates infinite connections to itself on Port 25.
NC-59406	Firewall	Kernel crashed due to conntrack loop.
NC-59809	Firewall	Loopback rule not hit when created using server access assistance (DNAT) wizard and WAN interface configured with network rather than host.
NC-59929	Firewall	Firewall rules not visible on GUI. Page stuck on loading.
NC-60078	Firewall	WAF: Certificate can't be edited for API XML import.
NC-61226	Firewall	Different destination IP address is shown in log viewer for Allow and Drop firewall rule when DNAT is on.
NC-61250	Firewall	Memory leak (snort) on XG 430 rev. 2 running SFOS v18.
NC-61282	Firewall, HA	Failed to enable HA when a new XG Firewall replaces an existing XG Firewall.
NC-62001	Firewall	Kernel panic on XG 550.
NC-62196	Firewall	Policy test for firewall, SSL/TLS and web with day doesn't match schedule rule.
NC-63429	Firewall	Kernel stack is corrupted in bitmap hostset netlink dump.
NC-65492	Firewall	User isn't able to generate access code for policy override.
NC-59747	Firmware Management	Upgrade to 18.0 SR4 failed on Azure.
NC-58618	FQDN	[coredump]fqdnd in Version 18.0.2.
NC-62868	HA	HA - Certificate sync fails in auxiliary device.
NC-64269	HA	IPv6 MAC-based rule not working when traffic is load balanced to the auxiliary device.
NC-64907	HA	Auxiliary appliance crashes when broadcast packet is generated from it.
NC-65158	Hotspot	Voucher export shows encrypted PSKs with secure storage master key.
NC-57661	IPS-DAQ-NSE NEMSPR-98	Browser "insecure connection" message when NSE is on but not decrypting.
NC-58391	IPS-DAQ-NSE	TLS inspection causing trouble with incoming traffic.
NC-61498	IPS-DAQ-NSE	Symantec endpoint updates URL failed when DPI interferes.
NC-63242	IPS-DAQ-NSE	SSL/TLS inspection causing outbound traffic issues with Veeam backups.
NC-59774	IPsec	Charon shows dead status.
NC-59775	IPsec	Sporadic connection interruption to local XG Firewall after IPsec rekeying.
NC-60361	IPsec	Incorrect IKE_SA proposal combination being sent intermittently by XG Firewall during IKE_SA rekeying.
NC-61092	IPsec	Strongswan not creating default route in table 220.
NC-62749	IPsec	Responder not accepting SPI values after its ISP disconnects.
NC-61101	L2TP	Symlink not created for L2TP remote access.
NC-62729	L2TP	L2TP connection on alias interface not working since update to 18.0.
NC-59563	Licensing	Apostrophe in email address prevents the "Administration" menu from loading.
NC-63117	Logging Framework	Garner is core-dumping frequently.
NC-61535	Network Utils	Diagnostics, tools, ping utility not working with PPPoE interface.
NC-62654	nSXLd	NSXLD Coredump caused the device not to respond.
NC-59724	RED	Backup from 17.5 MR10 doesn't restore on 18.0.
NC-60081	RED	Unable to specify username and password when using GSM 3G/UMTS failover.
NC-60158	RED	FQDN host group appearing in RED standard-split network configuration.
NC-60854	RED	RED S2S tunnel static routes disappear on firmware update.
NC-63803	RED	FailSafe mode after backup restore. Unable to start RED service.
NC-55003	Reporting	Keyword search engine report not working.
NC-59106	Reporting	Security Audit Report (SAR) missing information under "Number of attacks by severity level".
NC-60430	Reporting	XG Firewall sends duplicate copies of schedule executive report.
NC-60851	Reporting	Scheduled reports aren't sent.
NC-62804	SecurityHeartbeat	Registration to central security heartbeat doesn't work through upstream proxy.
NC-62182	SFM-SCFM	Administrator unable to change password of 18.0 device from SFM/CFM.
NC-61313	SNMP	Memory utilization mismatch between UI and atop/SNMP.
NC-64454	SNMP	XG 86: /tmp partition becomes 100 per cent full due to snmpd logs.
NC-53896	SSLVPN	Enforce TLS 1.2 on SSL VPN connections.
NC-60302	SSLVPN	All the SSL VPN live connected users get disconnected when administrator changes the group of a single SSL VPN connected user.
NC-60184	UI Framework	Missing HTTP security headers for HSTS and CSP.
NC-61206	Up2Date Client	Firewall fails to fetch hotfixes and ppatterns: File /conf/certificate/u2dclient.pem missing.
NC-62689	VFP-Firewall	When FastPath (firewall-acceleration) is on, traceroute shows time-out on the XG Firewall hop.
NC-63783	VFP-Firewall	Unable to start IPS.
NC-64470	VFP-Firewall	Auto reboot/nmi_cpu_backtrace due to VFP. Turning off firewall acceleration fixed the issue.
NC-63058	VirtualAppliance	Incorrect virtual XG Firewall model name appears in GUI and CLI.
NC-47994	Web	Pattern updates for SAVI and AVIRA are failing.
NC-54173	Web	URL Group: Add URL control fails when there's leading or trailing white space.
NC-51888	WebInSnort	IPP/AirPrint not accessible after upgrade of software appliance firmware to 18.0 EAP1.
NC-54978	WebInSnort	When an HTTPS connection isn't decrypted, reports show a hit to the site but no bytes are sent or received.
NC-62448	WebInSnort	Core dump on Snort.
NC-63515	WebInSnort	NSE: Unsupported EC type with application control and web policy.
NC-64875	WebInSnort	HTTP pipelining errors in DPI mode with non-pipelined traffic.
NC-60615	Firmware	Ambiguous alert shown during firmware upgrade to 18.0 MR1 for HA.
NC-59809	NAT	Loopback rule created using server access assistant and WAN interface configured with network not matched.
NC-61507 and NC-52716	Route-based VPN	XFRM traffic dropped when there's a NAT MASQ rule on the listening interface.

Version 18.0 MR3 Build 457

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-58229	Authentication	Failing Sophos AV and Avira AV pattern updates.
NC-51876	Core Utils	Weak SSHv2 key exchange algorithms.
NC-58144	DNS	XG Firewall reporting its own lookups in ATP causing a flood of events.
NC-54542	Email	Email banner added to incoming emails.
NC-59396	Email	Blocked senders able to send emails.
NC-58159	Firewall	Unable to ping external IP addresses from the auxiliary appliance console.
NC-58356	Firewall	Direct proxy traffic doesn't work when RBVPN is configured.
NC-58402	Firewall	Firewall restarts randomly.
NC-59399	Firewall	ERROR(0x03): Failed to migrate configuration. Loading the default configuration.
NC-60713	Firewall	User portal hotspot voucher configuration times out.
NC-60848	Firewall	HA cluster: Both devices restart unexpectedly.
NC-59063	Firmware Management	Remove expired CAs from SFOS.
NC-44455	HA	System-originated traffic not flowing from the auxiliary device when SNAT policy is configured for system-originated traffic.
NC-62850	HA	Filesystem anomaly in /conf.
NC-58295	IPsec	Dropped due to TLS engine error: STREAM_INTERFACE_ERROR.
NC-58416	IPsec	IKE SA re-keying doesn't re-initiate itself after re-transmission time-out of 5 attempts.
NC-58499	IPsec	Sophos Connect client "IP is supposed to be added in the ##ALL_IPSEC_RW".
NC-58687	IPsec	IPsec tunnel not re-initiated after PPPoE reconnect.
NC-58075	Netflow/IPFIX	Netflow data not sending interface ID.
NC-55698	nSXLd	Unable to add new domain in custom category.
NC-62029	PPPoE	PPPoE link doesn't reconnect after disconnecting.
NC-57819	RED	XG Site-to-site RED tunnel disconnects randomly with 17.5.MR10 and 18.0.
NC-60240	RED	Interfaces page is blank after adding SD-RED 60 with PoE selected.
NC-61509	RED	RCA site-to-site RED tunnel static routes disappear with firewall update.
NC-59204	SFM-SCFM	Task queue pending but never applies with XG 86W appliance.
NC-60599	SFM-SCFM	Task queue pending but never applies because of improper encoding.
NC-62304	SFM-SCFM	Notification email sent from XG Firewall shows the wrong Sophos Central administrator.
NC-61956	UI Framework	Web admin console and user portal not accessible because of space issue in certificate name.
NC-62218	UI Framework	Post-auth command injection through the user portal 1/2 (CVE-2020-17352).
NC-62222	UI Framework	Post-auth command injection through the user portal 2/2 (CVE-2020-17352).
NC-58960	Up2Date Client	HA: IPS service observed DEAD.
NC-59064	Web	Appliance becomes unresponsive: awarrenhttp high memory consumption.
NC-60719	WebInSnort	DPI engine intermittently causing website to load slowly.
NC-61367	CAPTCHA	CAPTCHA issue for IPv6 on LAN zone is resolved.

Version 18.0 MR1 Build 396

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-30903	Authentication	STAS configuration can be edited through the GUI on AUX machine.
NC-50703	Authentication	Access server restarted with coredump using STAS and Chrome SSO.
NC-50716	Authentication	Cannot import LDAP server through the XMLAPI if client certificate is "None".
NC-54689	Authentication	Support download certificate for iOS 13 and above.
NC-55277	Authentication	Service "Chromebook SSO" is missing on Zone page.
NC-51660	Backup-Restore	Restore failed using a backup of XG135 on SG230 appliance.
NC-55015	Bridge	Wi-Fi zone is not displayed while creating bridge.
NC-55356	Bridge	TCP connection fails for VLAN on bridge with HA Active-Active when source_client IP address is odd.
NC-52616	Certificates	Add support for uploading of CRLs in DER format.
NC-55739	Certificates	EC certificate shows up as "RSA" in SSLx CA certificate drop-down list.
NC-55305	CM (Zero Touch)	System doesn't restart on changing time zone when configured through ZeroTouch.
NC-55617	CM (Zero Touch)	Wrong error message in log viewer after ZeroTouch process.
NC-55909	Core Utils	Unable to see application object page on SFM.
NC-30452	CSC	Dynamic interface addresses not showing on AUX after failover.
NC-55386	Dynamic Routing (PIM)	PIM-SM import fails with LAG as dependent entity.
NC-55625	Dynamic Routing (PIM)	In HA with multicast interface, routes are not getting updated in the AUX routing table.
NC-55461	Email	After adding or editing FQDN host with smarthost, it is not displayed on the list until the page is refreshed.
NC-58898	Email	Potential RCE through heap overflow in awarrensmtp (CVE-2020-11503).
NC-55635	Firewall	Display filter for forwarded traffic is not working properly on packet capture page.
NC-55657	Firewall	HA backup restore fails when port name is different in backup and appliance.
NC-55884	Firewall	IPS policy ID and appfilter ID not displaying in firewall allow log in the log viewer.
NC-55943	Firewall	Failed to resume existing connection after removal of heartbeat from firewall configuration.
NC-57084	Firewall	Custom DMZ not listed in dedicated link HA configuration.
NC-44938	Firmware Management, UX	Web UI does not show reasons for firmware upload failure.
NC-55756	Gateway Management	Gateway isn't deleted from SFM UI after being deleted from SFM.
NC-55552	HA	WWAN interface showing in HA monitoring ports.
NC-55281	Import-Export Framework	Full configuration import fails when using third-party certificate for webadmin setting.
NC-55171	Interface Management	VLAN Interface IP is not assigned via DHCP when gateway name uses some special characters.
NC-55442	Interface Management	DNS name lookup showing incorrect message.
NC-55462	Interface Management	Import fails on configuring Alias over VLAN.
NC-55659	Interface Management	Invalid gateway IP and network IP configured using API for IPv6.
NC-56733	Interface Management	Patch PPPd (CVE-2020-8597).
NC-51776	IPS Engine	Edit IPS custom rule protocol doesn't work after creation.
NC-51558	IPsec	Add warning message before deleting xfrm IPsec tunnel.
NC-55309	Logging	Local ACL rule not created through log viewer for IPv4 and IPv6.
NC-50413	Logging Framework	Gateway up event log for PPPoE interface not always shown in the log viewer.
NC-55346	Logging Framework	Clear All for "Content filtering" does not clear SSL/TLS filter option.
NC-56831	Policy Routing	SIP traffic doesn't work at times with SD-WAN policy route.
NC-46009	SecurityHeartbeat	Spontaneous reconnect of many endpoints.
NC-51562	SecurityHeartbeat	Heartbeat service not started after HA failover.
NC-52225	Synchronized App Control	SAC page loading issues as the list of apps increases.
NC-54078	UI Framework	Internet Explorer UI issue on certain rules and policies pages.
NC-56821	Up2Date Client	SSL VPN downloading with 0 KB.
NC-54007	Web	File type block messages sometimes contain mimetype rather than file type.
NC-60108	API Framework	Pre-auth SQLi in API interface OPCODE.
NC-59156	CSC	Traffic not passing after upgrade to SF 18.0 MR1.
NC-59300	Email	Blind pre-auth SQLi in spxd on port 8094.
NC-23160	Firewall	LAN test failed in Port3 in SFLoader for 125/135 desktop model.
NC-59586	Network Utils	Remove MD5 remnant.
NC-46109	RED	No proper forwarding if bridging 3 or more RED site-to-site tunnels on XG Firewall.
NC-50796	RED	All RED site-to-site tunnels restart when configuring one RED interface.
NC-60162	Reporting	Error 500 displayed for web admin console and user portal after HF4.1 applied on virtual XG Firewall.
NC-60171	Security, UI Framework	Admin to super admin privilege escalation.
NC-59427	SFM-SCFM	SQLi in user portal.
NC-59932	UI Framework	Unable to sign in to the user portal or web admin console using IE after HF4.1.

Version 18.0 Build 379

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-59408	API Framework, UI Framework	SQLi prevention in hybrid request - ORM fields and mode parameters (CVE-2020-12271).
NC-58898	Email	Potential RCE through heap overflow in awarrensmtp (CVE-2020-11503).
NC-59300	Email	Blind pre-auth SQLi in spxd on port 8094.
NC-59454	UI Framework	Enable apache access logs.

Version 18.0 Build 354

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-57910	Base System (deprecated)	Unable to upgrade from 17.5 MR9 to 18.0 GA.
NC-56732	Firewall	Kernel panic after update to 18.0 GA due to SSLVPN.
NC-57067	IPsec	Sophos Connect lease doesn't support more than 255 IP addresses in the address range.

Version 18.0 Build 339

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-54339	Config Migration Framework	17.5 MR10 to 18.0 GA migration support
NC-56550	Policy Routing	SD-WAN policy routing screen smudge with blue strip
NC-56201	RED	Backup/Restore failure from 17.5 MR9 to 18.0 with specific RED configuration
NC-56397	Web	Certificate error received by the user

Version 18.0 Build 321

Fixed issues, listed by ID, description, explanation and Workaround.
Issue ID	Component	Description
NC-33664	App Signature	Unable to block Psiphon
NC-42675	Authentication	access_server returns 'Login Failed' if two awarrenhttp threads call in at same time
NC-44686	Authentication	Import/export of AUTHCTA has missing and incorrect values
NC-48116	Authentication	Importing users via csv file with special character in password fails
NC-50521	Authentication	User group assignment issue with LDAP users
NC-54642	Authentication	Authentication not working due to high CPU utilization of access_server
NC-50136	Backup-Restore	ISP failover for 2 PPPoE connections is not working for local LAN systems
NC-51979	Backup-Restore	Can't reflect time zone from restoring backup file after factory resetting
NC-32336	Base System	gpg vulnerability (CVE-2018-12020)
NC-42490	Base System	Validation function for legacy objects does not get called
NC-55640	Bridge	Firewall rule id not matching if traffic is going into wifi interface
NC-45935	Certificates	Fingerprint not updated on Default CA regenerate event
NC-49023	Certificates	Webproxy signing with non default certificate when using HTTPS Scanning
NC-54562	Certificates	CAs are missing after update from v18 EAP2 to EAP3
NC-29869	Clientless Access(HTTP/HTTPS)	"Internal Server Error" after adding many VPN bookmarks
NC-48516	Config Migration Framework	Configuration migration log on console is wrong in case of failed migration
NC-55270	Config Migration Framework	Report migration failed
NC-49648	CSC	API Get BridgePair requests sometimes report incorrectly "No. of records Zero."
NC-52857	CSC	One time scheduler doesn't work as expected in case of DST
NC-51717	DDNS, Email	DDNS uses wrong IP when interface is configured with PPPoE + Alias
NC-38763	DHCP	IP not leased to DHCP only interface when update from stateless
NC-38795	DHCP	IPv6 not removed from DB while disable DHCPv6 manage flags from RA server
NC-38930	DHCP	Editing DHCPv6 interface with auto configuration does not get IP from DHCPv6 server
NC-39157	DHCP	DHCPv6 client option "Accept other configuration from DHCP" is not working
NC-50214	DHCP	DHCP server dead with specific configuration
NC-51957	Documentation	Showing fastpath load failed with command "console> system firewall-acceleration show"
NC-48712	Email	Antivirus service in stopped state, cannot recover it
NC-51340	Email	Mailscanner child process causing OOM events when editing blocked senders list
NC-51347	Email	Error message "undefined" received when trying to add host
NC-51883	Email	API error 599 when performing GetRequest for various email modules
NC-52212	Email	Reject/Drop action not work correctly for oversized mails
NC-53016	Email	Email Blocked Senders cannot be updated
NC-55138	Email	SAVI AV update failed
NC-22659	Firewall	IPtable chains not created for firewall rule whose name contains blackslash '\\\\\'
NC-30482	Firewall	DNAT rules stop working after every reboot when migrating from UTM to SFOS
NC-36616	Firewall	Firewall group not available in APIhelpdoc
NC-37775	Firewall	Configuring over 20 time schedulers on the various firewall rules is causing CSC freeze
NC-43017	Firewall	Full config export does not include Security Policy group
NC-43415	Firewall	In the firewall rule, types of services are not translated
NC-48803	Firewall	Virtual Host update is calling on every FQDN IP update even its not used in virtual host configuration
NC-49101	Firewall	Group description delete issue in firewall
NC-49678	Firewall	Default ICMP service not matching in policy test tool
NC-50222	Firewall	Firewall rule position display is incorrect on rule deletion
NC-50549	Firewall	Drop packet does not show all the information for firewall rule ID 0 drop compare to v17.5
NC-50712	Firewall	NAT rules UI error
NC-50949	Firewall	Wrong ARP behavior in relation to DNAT rules
NC-51867	Firewall	Denied firewall logs send to garner for allowed firewall rule even if logging is disabled
NC-51964	Firewall	DNAT rule stopped working after every reboot
NC-52395	Firewall	Getting wrong username in admin event for firewall rule group name update
NC-52429	Firewall	Web access lost for 10+ minutes after HA fail-over
NC-52638	Firewall	WAF is not able to connect to webserver via IPsec tunnel
NC-52662	Firewall	Continuous receiving 'fw_fp_invalidate_microflows:459: Queueing invalidate work ffff8801ed1bb5c0' error in syslog
NC-52853	Firewall	Observed feedback channel plugin of garner core dump on XG330
NC-52873	Firewall	Kernel warning message 'RIP: 0010:tcp_send_loss_probe+0x13f/0x1c0' observed in syslog
NC-53364	Firewall	Firewall rules are not getting created correctly using XML API
NC-53988	Firewall	Kernel panic on XG450 appliance
NC-54038	Firewall	Wrong notification message displayed after disabling firewall rule
NC-55261	Firewall	Appliance crashing with Kernel Panic
NC-55789	Firewall	Ipuser ipset dumps when user is authenticated via STAS
NC-47482	Firmware Management	Firmware mismatch issue - both firmware slots showing same firmware
NC-52441	Firmware Management	Some time firmware 'install' opcode getting timeout and installation failed
NC-38800	HA	Incorrect error message when configure HA A-A with DHCP interface
NC-39015	HA	Unable to configure peer administration port for HA A-P when one of IP family of the interface is Dynamic IP assignment
NC-30485	Import-Export Framework	Export full configuration some time fails with error - 'The request could not be completed'
NC-39229	Interface Management	XG unsynced with SFM when unbind any interface from SFM
NC-46514	Interface Management	Cyberoam backup restore fails when DHCPv6 interface configured
NC-48450	Interface Management	Table for interface widget is not visible in control center page
NC-49938	Interface Management	Some time traffic drop in bridge mode
NC-48956	IPS Engine	Modify IPS TCP Anomaly Detection setting to disabled in default setting
NC-53875	IPS Engine	IPS keeps getting started because of page allocation failure
NC-51568	IPS-DAQ	Coredump in snort
NC-52085	IPS-DAQ	Wget not working for IPv6 sites in bridge mode - SSL decrypt not working
NC-53363	IPS-DAQ	Internet traffic hang and all traffic dropped
NC-52641	IPS-DAQ-NSE	IPS Service DEAD
NC-54310	IPS-DAQ-NSE	CC terminals not establish a connection with server
NC-29370	IPsec	Tunnel is getting established even though PFS is disabled on the VPN client side and enabled in SFOS IPsec profile
NC-49919	IPsec	Dgd service stopped and unable to start
NC-33848	LAG	LAG advanced options not working when LAG is member of Bridge
NC-40683	LAG	LAG active mode import-export is not working
NC-52090	Logging	LogViewer: "Action is not Allowed" filtering not working in detailed view
NC-52762	Logging	LogViewer: system mentioned in upper case
NC-46114	Logging Framework	Improper input validation and email notification after failed login (Webadmin, SSH, ...)
NC-50127	Logging Framework	Garner coredump in HA setup at handle_sync_input
NC-51942	Logging Framework	Policy Test Tool not working if firewall rule created with destination network as country or country group
NC-37839	nSXLd	Proxy authentication is not cleared after config reload
NC-37841	nSXLd	Keywords are not deleted when custom web category is deleted
NC-54525	RED	S2S RED tunnel doesn't established on SFOS after EAP2 to EAP3 upgrade
NC-28022	Reporting	Incomplete field names on data anonymization page
NC-42864	Reporting	Reports downloaded in PDF format have logo too close to the first line in most pages
NC-43183	Reporting	When data anonymization is enabled, scheduled reports are showing "Not available" instead of anonymized string
NC-45154	Reporting	Cannot specify hour and minute properly in Detailed Custom Reports
NC-45236	Reporting	Reports sent 1 hour later than scheduled
NC-46178	Reporting	"Web Risks & Usage Visibility" not showing any data
NC-49273	Reporting	Filtering on blocked user activities not working as expected
NC-52120	Reporting	Daily Reports are received but it delayed by different time
NC-52125	Reporting	UTQ user data is empty in SAR report but populated in GUI dashboard report
NC-53072	Reporting	Events reports (Admin, Authentication and System) are not generating due to db query for insert query getting failed
NC-53369	Reporting	Application Categories shown as "Unclassified"
NC-54177	Reporting	UTQ not generating due to change in web categories names
NC-48718	Service Object	Unable to edit service object that is assigned to a firewall rule
NC-47585	SFM-SCFM	Backedup 'central reporting' config is not maintained after Restoring config
NC-53043	SNMP	Wrong data is displayed in SNMP query for CPU usage
NC-47348	SSLVPN	LogViewer logs are not generated for ssl vpn connection up or down events
NC-55228	SSLVPN	Site2site - SSLVPN client in HA is not initiating connection after active node shut down
NC-54150	Static Routing	Data insertion is failing if large number of connections are present and Live Connection page is loaded
NC-54314	Static Routing	Negative value is displayed in upstream/downstream bandwidth column
NC-51673	UI Framework	User portal redirect loop when using non-standard port
NC-55193	VFP-Firewall	Port self test reboots appliance - V18 fastpath
NC-23045	WAF	WAF - Increase default TLS version to v1.2
NC-51952	WAF	WAF firewall rule update failed after migration from 17.5 MR8 to 18.0 EAP1
NC-55034	WAF	Web server timeout of 0 leads to syntax error in reverseproxy.conf
NC-51156	Web	Dynamic app filter rules which do not contain any applications is enforced for all applications in WIS
NC-53402	Web	Appliance auto reboot due to OOM (out of memory)
NC-53709	Web	Tiktok video not working with plain firewall rule with SSL/TLS enabled
NC-54421	Web	SSLx Exception based on SAC does not work
NC-44346	WWAN	Celullar WAN does not takeover again on failover

Known issues

Known issues, listed by ID, description, explanation and Workaround.
Issue ID	Description	Explanation	Workaround
NC-72419	SSL VPN clients are unable to synchronize with updates to Permitted networks and Idle time-out in remote access SSL VPN policies.	When you update Permitted networks or Idle time-out in SSL VPN policies, the changes aren't pushed to VPN clients. The issue applies only to split tunnels.	Site-to-site and remote access SSL VPN configurations: When you have both these configurations, go to VPN settings > SSL VPN and change any value (example: Disconnect idle peer after). Changing the value and applying the SSL VPN settings restarts the VPN service. It also disrupts established tunnels. Only remote access SSL VPN configurations: On the command-line console, go to Device management > Advanced shell and enter the following command to delete the existing configuration file: rm -rf /tmp/openvpn/conf.d This doesn't disrupt established tunnels. For more details, see SSL VPN clients unable to synchronize some updates.
NC-68595	Unable to establish HA in QuickHA mode.	When the auxiliary device is configured with a dynamic administrative IP address or the default IP address, the firewall devices don't establish HA in QuickHA mode.	Change the default IP address for accessing the auxiliary device. Use a static IP address.
NC-69088	Unable to create Secure Storage Master Key on HA devices.	On HA devices migrated to 18.0 MR3 or MR4, administrators are unable to create the Secure Storage Master Key.	If you have a configuration backup, reset the firewall to factory configuration. Upgrade to 18.0 MR4 or later version. Restore the backup. Rejoin HA. If you don't want to reset to factory configuration, enter the following advanced shell commands: /bin/nsgenc reset -f /bin/nsgenc init reboot /bin/nsgenc status; echo $? If the result is 1, restore the backup. Upgrade to 18.0 MR4 or later version. Rejoin HA. If the result is 0, contact Sophos Support.
NC-69457	Packet drop after user signs out.	When a user signs out, the firewall rule information for the user’s connections is removed, and the firewall fields in conntrack are cleared. Firewall rules are evaluated for the next packet in the original direction, but not for the packet coming in the reverse direction.	Known behavior
NC-55068	XG 115 Rev.3 HDMI ports don't appear to be on.	These models show no HDMI output if a monitor isn't connected to them before you start these devices.	Will be resolved shortly.
NC-68908	On the web admin console, SD-RED doesn't show LTE support.	SD-RED supports LTE, but incorrectly shows 3G/UMTS failover on the web admin console.	Will be resolved shortly.
NC-67346	Unable to sign in from Sophos Central when login disclaimer is turned on.	The issue is specific to 18.0 MR4.	On the web admin console of XG Firewall, go to Administration > Admin and user settings, and turn off Login disclaimer. Alternatively, turn off Login disclaimer in all firewalls using CM2.0 group level policy management. However, when you apply the configuration the first time, all the default objects are pushed from CM, and local modifications are overwritten.
NC-58220	Captive portal users using Chrome browser aren't signed out.	After upgrading their Chrome browser to version 80.0.3987.132, captive portal users aren't signed out when they close the browser.	For a workaround, see Chrome Platform Status. Will be resolved shortly.

Supported platforms

SFOS 18.0 is supported on all XG and SG appliances with at least 4 GB of RAM.

With the new Xstream packet processing architecture, you will enjoy a nice performance boost on your existing hardware.

SFOS 18.0 won't be supported on older XG 85/105 and SG 105 models that have 2 GB of RAM but will run perfectly on the newer XG 86/106 models that have 4 GB of RAM.

Cyberoam appliances don't support SFOS 18.0. Models that don’t support version 18 will continue to be supported for the foreseeable future on version 17.5. However, you can restore Cyberoam firewall backups on XG Firewall operating on 18.0.

Upgrading to SFOS 18.0.5

You can upgrade from SFOS 17.5 (MR6 to MR15) and all SFOS 18.0 versions to 18.0 MR5 (build 586) and restore configuration backups.

Sophos Firewall devices already on 18.0 MR5 build 574 can migrate the firmware and restore the configuration backup to build 586.

Migration versions

We strongly recommend that you migrate only to the approved versions that are listed in the following table. If you try to migrate to other versions, XG Firewall shows an alert asking you to confirm the migration before it restarts. If you confirm the migration, XG Firewall restarts with the factory configuration, and you lose your current configuration.

Supported migration from 17.5 to 18.0
Migrate from 17.5	Migrate to 18.0
	MR1 (build 396)	MR2	MR3	MR4	MR5 (builds 574 and 586)*
17.5 MR6 to MR12	Yes	Yes	Yes	Yes	Yes
17.5 MR13 17.5 MR14 17.5 MR14.1	No	No	Yes	Yes	Yes
17.5 MR15	No	No	No	Yes	Yes

* We recommend that you migrate to SFOS 18.0 MR5 build 586 rather than to build 574.

Restrictions

18.0 and later versions require a minimum of 4 GB RAM. So, you can't upgrade the following models to 18.0 and later:

XG 85, XG 85w, XG 105, and XG 105w
SG 105, SG 105w

These models must remain on a 17.x version. See XG Firewall Lifecycle Policy and XG Firewall retirement calendar.

Cyberoam models don't support 18.0 and later firmware versions. However, you can restore Cyberoam firewall backups on XG Firewall operating on 18.0 and later.

Support for RED devices

The support details of XG Firewall for RED devices are as follows:

Doesn't support RED 10 devices.
Supports RED 15, RED 15w, and RED 50 devices.
Supports SD-RED 20 and SD-RED 60 devices.

Firmware

If your XG Firewall is on 18.0 MR3 or later, you can schedule firmware upgrades from Sophos Central.

Rollback (firmware switch) is supported. You can roll back to 17.5 MRx if you experience any issues with 18.0 and later. For example, the active firmware on the firewall is 18.0 and the other firmware version is 17.5. You can switch between these two versions. This doesn't change the configuration on either.

You can't downgrade from 18.0 and later to an older firmware using 17.5 or an earlier firmware file. The web admin console will show an alert.

18.0 and later use Grub boot loader. The changed bootloader can't recognize 17.x firmware. You can still use the hardware ISO of 17.5 or earlier to have the firewall on an older firmware version and restore the downgraded firmware's backup.

In 18.0, we moved to a more secure firmware signing method. The firmware update files now use the .sig extension and not the earlier .gpg extension.

The web admin console shows the specific reasons for firmware upload failure.

Backup and restore are supported. You can restore backups from the following on 18.0 and later versions:

SG firewalls running SFOS
Cyberoam firewalls
XG Firewall backups

HA

SFOS 18.0 moved to SSH tunnel-based secure communication for the HA cluster. If you're upgrading the HA cluster to 18.0 or later for the first time, both the devices in the cluster will reboot simultaneously once. You'll receive an alert on the UI before you can proceed.

Support

You can find technical support for Sophos products in any of these ways:

Visit the Sophos Community at Sophos Community and search for other users who are experiencing the same problem.
Visit Sophos support at Sophos Support.
Find how-to, configuration and troubleshooting videos at Sophos Techvids video hub.

Legal notices

Copyright © 2021 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respectiveowners.