
Sophos Firewall OS (SFOS) update v17.5 – MR4 released
Sophos has released version 17.5 MR4 for Sophos Firewall OS (SFOS).
Note: For more information on upgrading, see the following post: Upgrading SFOS firmware to Sophos Firewall.
Backup encryption
MR4 brings a feature to the XG that UTM users have known for years. The backups can now be encrypted. With a little effort, it was previously possible to read the admin password from an SFOS backup. Sophos says here that until now the configuration was encrypted with a common password that only Sophos knew. Therefore, in the past, we have tended to advise against sending backups via e-mail or uploading them to an FTP server.

We recommend changing the admin password and creating a secure password so that configuration backups are encrypted in the future. After that, you can send the backups by e-mail or upload them to an FTP server with a clear conscience.
Notifications
Email notifications on the XG are currently virtually non-existent. However, Sophos is working to ensure that these are improved in the future. With the new XG Firewall firmware there are now first improvements.

Other small improvements
- There is now an option to generate the application configuration file from the XG Firewall console and import it into GSuite. You can find it under Authentication > Services > “Download GSuite App Config”.
- GRE and RED interface support for PIM-SM added.
- Support for “DHE key exchange cipher suites” with HTTPS scanning.
Bug fixes
- NC-28883 [Authentication] Able to change group membership of backend users when authserver doesn’t exist anymore
- NC-38834 [Authentication] access_server service getting restarted due to heartbeat found dead
- NC-39735 [Authentication] User under an OU falls under OPEN GROUP upon authentication
- NC-40072 [Authentication] Not able to delete surfing quota profile, delete opcode search for accesspolicyid instead of surfingquotapolicyid
- NC-40945 [Authentication] Failed and successful logins at the same time
- NC-42329 [Authentication] Unable to upgrade from v17.1 MR4 to v17.5 GA
- NC-34479 [CSC] Virtual XG randomly rebooting – snort using up all swap
- NC-39990 [DHCP] When statically assigning an IP to a devices on multiple DHCP scopes, the gateway settings are pulled from the first one
- NC-34039 [Email] Websites are blocked by Sophos AV because of reason “Malware”.
- NC-38555 [Email] File Protection can’t block MIME type doc
- NC-38840 [Email] Unable to delete a particular email which was quarantined
- NC-40071 [Email] GUI option for offline relate on/off for inbound mails
- NC-40131 [Email] Mail downloaded from error queue doesn’t get displayed properly in mail client
- NC-40364 [Email] Personal email exception manipulation by other authenticated users
- NC-40389 [Email] Mails released from spool get an incorrect firewall rule ID
- NC-40666 [Email] Coredump in mailscanner
- NC-41061 [Email] SPX encryption leads to “carriage return and line feed” in attachments
- NC-41574 [Email] SPF should get applied on inbound mail sent from protected domain to protected domain from internet
- NC-41862 [Email] Mail log on GUI does not show delivered mails
- NC-42409 [Email] Bounce back mail due to recipients having MX records which point directly to an IP
- NC-43353 [Email] smtpd behavior is different from 17.1 to 17.5 (without subscription)
- NC-43703 [Email] Warren service unable to load EC type CA certificate.
- NC-35350 [Firewall] PPPoE interface status remains in status “Connecting” for 2 hours
- NC-39522 [Firewall] Network protection options in setup wizard of XG are misleading
- NC-39605 [Firewall] Modifying one time schedules fails, if timer has already triggered
- NC-39907 [Firewall] API command to enable SpoofProtection is not working
- NC-40176 [Firewall] Firewall rule is listed in business application rule destination network objects
- NC-40622 [Firewall] Incomplete MAC address shown in Log Viewer
- NC-41316 [Firewall] Update country host DB
- NC-41389 [Firewall] HA – system doesn’t send out garp upon failover
- NC-41632 [Firewall] Business Rule – port translation not working as expected
- NC-41652 [Firewall] Unable to delete vlan interface – “Interface could not be deleted”.
- NC-42342 [Firewall] One time timers are executed before expected time
- NC-39813 [FQDN] Unable to use underscore in FQDN host creation
- NC-37771 [Hotspot] Duplicate vouchers in export files
- NC-38004 [Hotspot] Hotspot password of the day is not getting reflected into run time config
- NC-38120 [IPsec] L2TP over IPsec is sending keepalives forever
- NC-38746 [IPsec] S2S connection is not initiated after DHCPv6 interface update
- NC-39267 [IPsec] IE11: cannot create and update IPsec policy
- NC-41299 [IPsec] IPsec SA is updated with incorrect SA information
- NC-42099 [IPsec] Sophos Connect Client cannot connect to Sophos Connect Client policy using digital certificates
- NC-42290 [Licensing] Additional CPU cores not detected in v17.5 after license upgrade (NC-26328)
- NC-40282 [Logging Framework] High CPU usage from garner / active.db grows continuously
- NC-34323 [RED] HA active-active routing issue over RED S2S tunnel
- NC-42159 [RED] Validation of provisioning file failed
- NC-40444 [RED_Firmware] Tunnel compression does not work
- NC-38899 [Reporting] Scheduled custom mail reports received via email does not show the mail size
- NC-40303 [Reporting] Log Viewer is not loading new logs after screen unlock
- NC-40983 [Reporting] Follow-up for NC-26459: Reports for “Traffic Insight” not shown on dashboard
- NC-41788 [Reporting] Unable to upload custom logo
- NC-41232 [SecurityHeartbeat] Heartbeat status on XG showing “at risk” instead of “green”.
- NC-36776 [Synchronized App Control] New Apps number doesn’t match the displayed list entries
- NC-37423 [Synchronized App Control] SAC Tab fails to load for high number of EPs and APPs
- NC-37815 [UI Framework] Guest User expiration is not correctly ordered
- NC-40158 [WAF] Disable TLS session tickets
- NC-34088 [Web] Application control shows blocked applications when they are not blocked
- NC-38892 [Web] Inappropriate description in web category for “Society & Culture”.
- NC-39517 [Web] Webfilter memory usage is growing over time and not going down
- NC-39817 [Web] Application filtering using “Smart Filter” filter disappear randomly
- NC-40265 [Web] Unable to run web policy test for generic top level domains
- NC-40503 [Web] Web filter policies not getting updated after CR to SFOS migration
- NC-42264 [Web] Garner on Aux node dead after upgrade to v17.5
- NC-43056 [Web] Policy tester activities shows junk characters in result with file download is blocked
- NC-38368 [Wireless] APs randomly going to INACTIVE STATE
- NC-38868 [Wireless] Time based scan with DCS is not showing after configuration for 5.0Ghz
- NC-39840 [Wireless] Wireless interface going to UNPLUGGED STATE
- NC-39986 [Wireless] 5 Ghz band is not available in AP setting while country set to Qatar
- NC-40091 [Wireless] Disable TCP Segmentation Offload for separate zone interface
- NC-38085 [WWAN] Unable to detect 4G USB Modem D-Link DWM-222 A1 on XG 125 and XG 85 with HW Rev.3