Sophos UTM

Sophos UTM (formerly Astaro Security Linux) is a commercial operating system designed from the ground up to be deployed as a firewall, gateway, anti-virus solution, intrusion protection system (IDS), VPN (Virtual Private Network), spam filtering, spyware protection and content filtering solution on small and medium-sized networks.

Available as a dual-arch, installable-only CD image

This product is available for download as a 30-day full featured trial, packaged as an installable-only CD image of approximately 650MB in size, suitable for both 32-bit (i386) and 64-bit (x86_64) hardware platforms.

Boot options

The boot menu is very minimal, instructing users that the installation will completely erase all data on the target drive, including the currently installed operating system and all applications.

To start the installation, just press the Enter key when you see the boot prompt, which will appear immediately after you have booted the CD/USB media from the BIOS of the PC.

To view the recommended hardware requirements and possible boot options, do not hesitate to press the F1 key on your keyboard. Pressing the F3 key will display a troubleshooting screen.

The distro is quite easy to install, despite the fact that it features a text-mode installer

The distro is quite easy to install, despite the fact that it features a text-mode installer that requires you to select a keyboard layout, timezone, set the date and time, configure the network interfaces and partition the disk. To access its web-based interface and configure the system, open a web browser from another computer on the same network and point it to the IP address posted at the end of the installation.

Bottom line

If you own a small or medium-sized business and you want a strong, secure and commercially supported server-oriented operating system to block unwanted spam, filter web content, protect your employees from spyware and viruses, as well as to deploy a capable Virtual Private Network (VPN) gateway or Intrusion Protection System (IDS), then Sophos UTM is for you.

What is new in this release:

• Major Features:
• Endpoint: Web Protection for UTM Endpoint
• Network/RED/Wifi: Support for MAC Address Filtering
• RED: Offline Provisioning Mode
• VPN: SSL VPN Support for iOS and Android
• WiFi: Wireless Repeating and Bridging for AP50
• Other Features (Sample):
• WebAdmin: Replace "Traffic Lights" with Toggle-Switch Design
• WebAdmin: Replace Flash Charts with JavaScript-only Solution
• Endpoint: SAA for MacOS X
• Mail: SSL Support for POP3 Proxy
• Network: QoS Download Throttling
• Network: IPv6 Prefix Delegation
• Network: IPv6 Renumbering
• Network: DNSSEC Validation
• Network: Allow to specify direction of Country Blocking
• Network: Exceptions for Country Blocking
• Network: Increase Scalability of Network Reporting/Accounting
• Network: Multilink PPP Support
• Network: Amazon VPC IPSec Tunnel Support
• RED: Auto-Deauthorize Devices
• RED: Improve UMTS Modem Support
• RED/VPN: Notifications for tunnel up/down
• VPN: SSL VPN Profiles
• VPN: Support for AES+GCM and AES+CTR Ciphers in IPSec
• WAF: Outlook Anywhere Passthrough Support
• Web: Complete Customization of Block Pages
• Web: Optionally Force Caching of Sophos Endpoint Updates
• Web: Allow to specify Maximum Download Size
• Wifi: Redirect Support for Hotspot
• General: Database Architecture Overhaul
• General: More Services Support Lock-Out after Failed Authentication
• General: Time-Events can Span Across Midnight
• Fixes:
• #15089: Support for Outlook Anywhere protocol via the Web Application Firewall (Web Server Protection)
• #17999: It's not possible to take over the Internet explorer(8 & 9) proxy settings with the SSL VPN client
• #18601: Checkbox "Mime blocking inspects HTTP body" enabled does not work when Antivirus scanning is disabled
• #19006: Internet Explorer still doesn't trust the webadmin certificate after importing the WebAdmin CA
• #20050: gzip deflate compression not working with WAF
• #21494: IPS report for pdf and csv is incorrect
• #21590: Fix SNMP traps for notifications
• #21825: Form hardening breaks ‘XHTML 1.0 strict' compliance
• #21829: Timeframe and Department missing in PDF header lines
• #21857: Reporting: in the Top Applications by Client PDF export the total column is displayed twice
• #21861: Application Control Reporting: incorrect data in the exported pdf/xls
• #21892: Encryption User: Download PKCS#12 key doesn't work if S/MIME is disabled
• #21898: Web Protection Reporting: missing sorting order in pdf under some circumstances
• #21928: SSL certificate exceptions do not work for urls with an IPv6 literal as hostname
• #21942: IPS notifications contain invalid links
• #21957: DHCP server not working properly with large IP ranges
• #21958: Live log for packetfilter shows numbers instead of the protocol
• #22371: The NAT rule object cannot use network group objects for the traffic destination attribute with uplink primary address
• #22546: RED Split-Tunneling via UMTS is not working properly
• #22634: Static IP address assignment for RED does not work together with transparent/split mode
• #23333: Blocked application name on the block page is truncated
• #24156: Search Engine Report => Top 10 pie chart has label with HTML "br" tag in description.

What is new in version 8.300:

• Amazon Machine Images (AMI) for ASG (and ACC):
• As mentioned in our earlier technical preview, you can now launch and run Astaro Security Gateway inside Amazon's Elastic Computing Cloud (EC2). Already we are seeing creative uses of this deployment method with partners using their cloud-based ASG to connect our RED product, and then extending their branches further by adding our Access Points to those devices - all managed centrally from their Amazon ASG. Let us know via a post at our UBB at www.astaro.org how it works for you, and how you are (or plan) to use it for your business - we are always interested in use cases! To locate the ASG AMI's, go to the community AMIs tab and search for "ASG". (A full deployment tutorial will be available at GA)
• Amazon Virtual Private Cloud (VPC) Connector:
• The Amazon VPC service allows you to host and run your server infrastructure in a secure, scalable cloud. Our VPC connector gives you a permanent, encrypted connection to your VPC resources right from ASG. The back end for this uses our new BGP routing to redundant Amazon gateways, and is done automatically without you needing to know anything about BGP or the Amazon technical parameters for doing it manually (or with more complex products). A guide will be available at GA release to assist you in connecting to your VPC.
• Support for Astaro Wireless AP50:
• Our new Wireless AP50 product is finished production and will be available very soon. You will need to be at ASG V8.300+ to use this product. With 5Ghz and 2.4Ghz bands, dual high-gain antennas, and Gigabit ethernet, this is our biggest and most capable wireless product, perfect for bigger environments or locations where the 2.4Ghz band is cluttered with interference. You can get more information from the Astaro Access Points section on our Website.
• Site-to-Site VPN using RED Protocol:
• We have added the ability to make tunnels between ASG devices using our much-heralded RED tunnel technology*. This operates similarly to how site-site over SSL works, you setup one ASG as the "Main" office (Server) and connect to them from other ASG sites as the "Client". Some quick steps to begin:
• At the Main Site:
• Go to "WebAdmin-->RED Management-->[Server]Client Management Tab"
• Add a RED, enter a name and pick type "ASG". Click Apply.
• Download the .red provisioning file which is created.
• On the Remote ASG you wish to connect:
• Go to "WebAdmin-->RED Management-->[Client]Tunnel Management"
• Add a tunnel, create (or select) a definition for the Hostname of the Main ASG and supply the provisioning file you downloaded from the Main ASG
• The tunnel will now be created.
• Now that you have a tunnel, you must to setup things manually. You will find hardware interfaces you can use to create a Network Interface in the ASG's, select IP ranges to be used, and otherwise manually configure the connectivity. This was originally designed for a special use case; you have however surprised us with your interest in this feature. So, we plan to have a more guided setup within WebAdmin for using RED for a site-site VPN with ASG's in a future Up2Date.
• *This will NOT turn your remote ASG into a RED terminal. It will still have a GUI and work like a normal Site-Site VPN does.
• BGP4 Routing Support:
• ASG now has the ability to do Border Gateway Protocol Routing (BGP). You will find the configuration for this in WebAdmin at "Interfaces & Routing-->Border Gateway Protocol". A specialized routing protocol with specific applications, you should make use of this feature only if you know what you are doing.
• Minor Adjustments:
• The Astaro Authentication Agent (AAA) has by popular request been made available as an MSI package as well as an EXE. You will find both on the Client Authentication section in WebAdmin. Enjoy your mass roll-outs of the AAA!
• Saved Web Reports have been to school and now remember how info was sorted when you saved them
• The printable configuration engine has also been educated on how to properly display big blocks of text without going outside the lines and now looks much better
• You can now see and sort application rules by the groups you create
• Notifications have had "select-all" boxes added, saving you from having to click dozens of times to select what you want
• You can now create Web Security Reports from Pre-8.2 Logs, see Support-->Advanced-->Weblog Import
• The Wireless Access Points Grouping section now has an apply button like the rest of WebAdmin, and no longer resets your selections between clicks as a result.

What is new in version 8.170 Beta:

• This beta version adds support for Hurricane Electric IPv6 tunnel broker and advanced options for IPSec site-to-site connections.
• It also fixes several bugs.

What is new in version 8.164 Beta:

• This Beta release introduces Stripped Backups/"Templates", SNMP version 3 support, a new IRQ balancer for improved network performance, improved HTTP/S Proxy operation mode selection, some changes in the WebAdmin menu, and SHA2 support for Site-to-Site IPSec between ASG V7 and ASG V8. It also fixes a number of bugs.

What is new in version 8.160:

• This is the first public beta release of the upcoming version 8.2, which will include these three new features: network visibility and application control (L7 classification), new WebSecurity reporting, and user authentication (Windows client) for policies and reporting.
• It also includes a UMTS modem interface, KVM virtio support, WiFi improvements, Web application security improvements, integration of log management cloud service, IPv6 support for SMTP proxy and HTTP proxy in "full transparent" mode, Packetfilter optimization, and HTTP proxy multi-threading performance optimization.

What is new in version 8.102:

• This small Up2Date is a stability release designed to enhance the reliability of your Astaro Security Gateway, mainly to fix minor issues in the HTTP/S proxy.

What is new in version 8.100:

• This big new release adds wireless support, transparent/split modes and a deployment helper for RED, German and Japanese language support, uplink balancing mixed mode, and HTTP parent proxy routing. It also changes the licensing, so DNS routing is available with any subscription now. Usability was improved. A problem with QoS and RED was fixed.

What is new in version 8.080:

• This is the second release candidate before the release of ASG 8.100.
• Besides various bugfixes, it also includes a German and Japanese manual and online help.

What is new in version 8.001:

• This version fixes some bugs with how Web Application Security handles connections for protection of Outlook Web Access servers.
• It also adjusts the very popular Country Blocking.
• In addition, some other bugs were addressed and some hardware glitches for software users and their platforms of choice were solved.
• It also addresses an issue regarding Unix Time which can affect the use of certificates, and thus your ASG installation.
• This up2date package should be applied before the end of August if possible.

Limitations:

• 30 day all feature on trial period