"security made simple" is a vital aspect of network security and in keeping with that model I suggest the following checks while creating host definitions:

1. When creating a host with an assigned IP, the system should check if that IP is already assigned or not. In a large scale network even though you can search and sort host definitions, it is prone to human error and therefore proper rudemantory checks by the system during creation should be performed.

1.1 one should not be able to create a host with an IP within a dynamic range

1.2 one should not be able to create a host with an IP matching an existing static mapping

When the UTM is sync with Active Directory, it would be nice for the UTM not to keep old Active Directory accounts within the UTM device, and for the ability for the UTM to keep upto date users from AD when the UTM does a sync,

as we are a school and we use the utm for the filtering / authentication - having to go through over 1000, accounts and remove them from the utm device is somewhat time consuming, if this could be added as a feature it would be really great and i'm sure other people would agree.

thank you

Feature Request eine generelle Option in der GUI wird benötigt , damit nur Forward Secrecy fähige Ciphers verwenden werden können, damit auch andere TLS Versionen damit abgedeckt wären.

Das Problem ist, das das BSI im April neue technische Maßnahmen für den IT-Grundschutz heraus gegeben hat.

Darin wird für Web-Anwendungen nur noch TLS 1.2 und TLS 1.3 mit FS empfohlen.

Der eingriff über CLI ist nicht gewünscht:
................................................
/var/storage/chroot-reverseproxy/usr/apache/conf/reverseproxy.conf
Finden Sie recht weit oben die Zeile :
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
Das was hier eingetragen ist. wird vom Rev-Proxy angeboten.
Änderungen hier und Folgeprobleme (Sitchwort Backportability alte Clients zu neuen Cipher suites) sind dann out of support scope.

Daher ist es wünschenswert in der GUI einen Schalter dafür zu haben.

Hier ein Beispiel:

https://www.ssllabs.com/ssltest/analyze.html?d=oma.sparkassen-immo.de&hideResults=on
Sollte aber nur noch TLS-ECDHE erlauben mit FS.

When one clicks the [Make Static] button on the 'IPv4 Lease Table' tab, there should be a check that the IP to be used is outside the 'DHCP Range' listed. Prior to that button existing, we just used the regular Host definition process, but that's probably more difficult. Even then, a quick check to see if the assigned IP is in any DHCP range would seem to be easy. For example, I just got the following:

secure:/root # cc get_objects dhcp server|grep \'range
'range_end' => '172.16.31.110',
'range_start' => '172.16.31.101',
'range_end' => '192.168.66.254',
'range_start' => '192.168.66.100',
'range_end' => '10.100.100.63',
'range_start' => '10.100.100.40',
'range_end' => '172.16.2.199',
'range_start' => '172.16.2.100',

Cheers - Bob

Hi,

as mentioned in support case #8595985 I suggest to make the Sophos UTM Mail Encryption to support the way that Google Suite is handeling SMIME Encryption.

At this moment we are unable to decrypt SMIME-encryted and -singed mails from ALL of our customers and partners which are using an Google Gsuite Account with SMIME-Encryption.
As a result of Develoments research (which took already 7 months) I got an Information from support that Google is using a different way to handle SMIME, which is not supportet by UTM:

"the UTM expects encrypted mail, it first decrypt the mail and verify then after. Any service want to work with UTM/SMIME has to follow this in accordance with existing design. This way ({ [SIGN+ENCRYPT] + SIGN }) is currently not supported and will be handled as a feature request."

Kind regards
Daniel