Just completed a cutover from a legacy Cisco ASA pair to a Sophos XGS 5500 cluster for a 2000-user finance firm. The sales pitch promised seamless migration and superior performance. Reality was a 14-hour weekend with three critical failures that our Sophos SE's "best practices" guide didn't cover.
The main points of failure:
* **HA Sync Heartbeat Collapse:** The cluster's HA sync interface failed to establish after the primary node booted. The secondary stayed in passive mode, refusing to sync policies. Turns out the default HA monitoring sensitivity was set too high for our data center's existing network latency. Had to drop to CLI to adjust thresholds before the sync would initialize, losing an hour.
* **SSL Inspection Breakage on Legacy Core Apps:** We rolled out with SSL inspection active per their security template. It immediately broke two critical legacy internal financial applications that used pinned certificates and non-standard TLS handshakes. No errors in the Sophos logs—just connection resets. Had to build exclusion rules on the fly mid-cutover, which required a full policy re-provision each time.
* **Web Server Protection False Positives:** The built-in web protection module flagged our internal SharePoint server's traffic as a "suspected brute-force attack" and started dropping connections for entire departments. The default aggression profiles are, frankly, ridiculous for a corporate environment. Had to disable that specific signature set globally to restore access.
The hardware is solid and throughput is good, but their default configuration profiles are built for a greenfield SMB, not a complex enterprise with legacy dependencies. The migration utilities also failed to translate our VPN site-to-site configurations correctly, leading to another manual rebuild.
Anyone else pushed an XGS into a large, complex environment? What was your biggest unexpected hurdle, and what specific tuning did you need to do post-cutover to make it actually work?
- No fluff.
The HA sync latency issue is a known but under-documented pitfall, especially in environments with stretched layer 2 segments or legacy switching. The default 200ms heartbeat timeout assumes a near-perfect fabric. We've standardized on setting the heartbeat interval to 1000ms and the dead-time multiplier to at least 5 during staging, then tuning down post-cutover once the sync link is proven stable.
Your SSL inspection problem points to a common gap in migration playbooks. For finance especially, you need a pre-cutover traffic analysis phase focused solely on identifying TLS handshake anomalies and certificate pinning. A tool like `openssl s_client` or a passive tap running Zeek can map these exceptions *before* you write a single firewall policy. Rolling out with a blanket inspection rule, even from a vendor template, is almost guaranteed to break something business-critical.
On the web protection false positives, was that the IPS or the WAF profile? The stock Sophos web server protection rules are notoriously aggressive with older Apache or IIS versions common in legacy finance apps. You usually have to run them in log-only mode for a full business cycle to baseline.
CPU cycles matter