Sophos Firewall v22 MR3: IPsec Compatibility and 16 Fixes

Sophos released Sophos Firewall OS 22.0 MR3 Build 576 on 16 October 2026. Following the feature additions in v22 MR2, the focus is on a smaller maintenance update: the official release notes list 16 resolved issues. There is also a new setting for site-to-site IPsec connections with third-party devices.

When planning the update, the main consideration is which services each firewall uses. A site with several VPN peers needs different acceptance tests from a firewall running Mail Protection or an HA cluster. MR3 should therefore be assessed against the individual configuration and installed during a planned maintenance window.

Third-party IPsec: the tunnel is up, but traffic is missing

MR3 adds a command that disables strict policy checks for site-to-site IPsec. This addresses peers that use the same Security Association (SA) for several subnet pairs. Incoming traffic could consequently be dropped if it did not match the expected SA.

In simple terms, an SA defines the security parameters of an IPsec connection. An established tunnel alone therefore does not prove that all intended networks can communicate with one another. Acceptance testing should cover every required combination, particularly where several local and remote networks are involved.

The new option is no reason to disable the check everywhere as a precaution. First, use IPsec troubleshooting to establish whether the symptoms actually match an SA mapping issue. Routing, firewall rules and NAT remain possible causes of a tunnel that carries no payload traffic. Our KB article Global VPN settings explains the syntax, scope and controlled use of ipsec-strict-policy-check in its section on strict IPsec policy checks.

For a reliable test, connections should be initiated in both directions. Packet captures and the counters of the tunnels involved help distinguish between traffic that never arrives, dropped packets and a missing return path.

Which fixes matter most in operation

The following points are a selection from the official release notes:

• NC-186809, HA: Certificate synchronisation could make WebAdmin and VPN Portal inaccessible.
• NC-186075, networking: RJ45 ports intermittently lost their link when connected to certain switches.
• NC-182635, Application Control: Repeated application path updates caused high CPU load.
• NC-181808, RED: Stale RED_DEVICE_DROP entries blocked traffic after reprovisioning.
• NC-183979, email: A large mail spool prolonged the restart during the MR2 upgrade.
• NC-180464, DNAT: SMTP traffic was incorrectly dropped after an upgrade.
• NC-184117, STAS: Already authenticated users were prompted to log in through the Captive Portal again.
• NC-182222, SSL VPN: Numeric usernames prevented connections after the MR1 upgrade.

The remaining entries concern user filters, syslog errors, AP VXLAN creation, HA deactivation, IPsec, signature databases and PDF reports.

In practice, this list should inform a short set of site-specific acceptance tests. For HA, these include access to the management interface and VPN Portal, as well as synchronisation status. At RED sites, a real application should be tested over the connection. For a mail gateway, incoming and outgoing delivery and the mail queue are more meaningful than a successful ping.

For CPU issues, a before-and-after comparison under a similar load is also useful. A matching fix in the release notes is a clue, but does not prove that the cause of a particular incident has been identified.

Config Studio 2.7 makes targeted changes easier

Alongside the firmware, Sophos introduces Config Studio 2.7. This separate browser tool can display specific changes and export them as XML or TAR. API requests can also be limited to added, changed and removed objects. Further fixes cover configuration comparison, the web exception helper and SD-WAN tunnel calculations.

The benefit is particularly clear during review: a small set of changes is easier to check than a complete configuration export. Before importing, however, check which dependent objects must already exist on the target system. A reduced export replaces neither a backup nor subsequent functional testing. Our article on Config Studio 2.6 explains the previous feature set.

Our KB article Planning a firmware upgrade covers preparation, including the upgrade path, backup and maintenance window. The individual steps in WebAdmin and through Sophos Fusion, along with post-upgrade checks and rollback, are described in Performing a Sophos Firewall firmware update.