"Enable" and support using of wildcard certificates for Mail Protection/SMTP Proxy.

Explanation:
We had a case where we used our existing official wildcard certificate also for our SMTP connection. There was no error importing and configuring it on the webinterface and most of the connections worked but some are not. Funny part of the story: also the Sophos Support salesforce mails didn't go through ;-) So as we use this certificate for nearly all our external connections it would be fine if we wouldn't need another one for the Sophos UTM. Technically I don't see the problem and half of the work seems to be done because it is working basically. There is only a special thing which is not working and this one is not revised because of this KB: https://support.sophos.com/support/s/article/KB-000034685?language=en_US...

I've recently tried to update the webadmin portal domain to some thing different to the hosts defined in the Webserver (Real/Virtual) area of the SOPHOS interface.

And yes, this is what bit me! Unwittingly I found I'd not only changed the domain of the webadmin portal but also all the defined webservers supporting our production environment!!!!

Ouch.

Not only that but the certificates that were used for TLS are no longer retrievable from the UI. So you have to act fast in finding them outside of SOPHOS and re-import and activate.

So it's a double whamy.

What I'd like to propose;

It needs to be clearly stated on the screen and in doco that the webadmin portal is fundamental to the domain host definitions and any changes will impact ALL hosted webservers – even though you appear to be in a webadmin (portal) only tab. Ideally the screen should also check for a change in host name from the webservers and give a final prompted warning of the danger. Better still, remove this functionality entirely from the webadmin tab and place on a dedicated “Core Host Domain” or similar tab.

Also don't block access to the certificates previously imported and active - if they could have been reselected I could have reduced the recovery time incredibly.

Please do something so that others will be saved others from this painful experience!

Thank you.

Situation:

In actual UTM all clients disconnect from APs when the time based SSID is being enforced

Expected behaviour was:

The time based network should restrict the access without reloading the AP configuration so clients can stay connected to different networks without being interrupted

GES confirmed current expected behaviour:

"Expected Behaviour through example:

SSID1 is configured with Time Based Access. SSID2 and SSID3 are configured without Time Based Access.

SSID1 and SSID2 are assigned to AP1.

SSID2 and SSID3 are assigned to AP2.

So when Timer expires (either enable or disable), AP1 will get reconfigured. That means all clients connected to AP1 irrespective of SSID will gets disconnected."

Is the error of Firefox Proxy Server giving you hard times? If yes, then it can occur because of many reasons; however, you can resolve this error by following the steps mentioned below:
• You need to force Firefox for using the Auto Detect Proxy Settings
• Add the URL SSL port in the allowed list
• You have to switch to HTTPS proxy
• You must disable the built-in proxy server in Windows 7, 8.1, 10
• Uninstall the VPN Client
If these steps don't help you fix the proxy server error, then it's best to reach out to certified experts by calling Mozilla Firefox Support Number that is available 24*7 around the clock.
Read more: - https://www.customerhelpsupport.com/how-to-fix-the-firefox-proxy-server-error/

Can we get a Windows 10 VPN plugin like the other vendors have done to allow SSLVPN over the standard Windows 10 VPN client.

This would solve all the deployment problems with the legacy client, No more saving passwords in text files, no more TAP adapters, no more messing with shortcuts to make the process transparent.

Here is an example of how easy deployment is with a plugin to the built in

Add-AppxPackage -Path "C:\VPN.Appx"
$xml = "<MobileConnect><Port>4433</Port></MobileConnect>"
$sourceXml=New-Object System.Xml.XmlDocument
$sourceXml.LoadXml($xml)
Add-VpnConnection -Name "Work Network" -ServerAddress https://vpn.work.com:4433 -PluginApplicationID SonicWall.MobileConnect_cw5n1h2txyewy -CustomConfiguration $sourceXml -RememberCredential $true

You can even configure the VPN connection to be always on and therefore completely transparent to the user.

https://docs.microsoft.com/en-us/previous-versions/windows/desktop/vpnclientpsprov/thirdpartyvpnconnection

https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/always-on-vpn-enhancements

There is no fallback to SPX encryption if the recipient does not support certificate-based encryption.

Zenario:
I have configured S/MIME and PGP for myself and I am sending an email with confidential content to someone who does not use S/MIME or PGP. The DLP recognizes that the e-mail should be encrypted by an expression.
However, the email is currently being sent unencrypted.
There should be a fallback to the SPX encryption, as the DLP has already recognized the email.

There is currently a security risk due to the missing fallback.

In our case the S/MIME and PGP functions must be deactivated and SPX enforced. It is not possible to use both methods together.

Please implement an S/MIME and PGP to SPX fallback.