Hey everyone, a little primer, I manage a small corporate network (Windows AD, consisting of 6 server, 50 users, and 3 remote branches) I don't have any formal education, but I've been managing our network for the last 15 years as the only on-site admin, and I utilize the help of a 3rd party IT company for larger projects and helpdesk support along the way.
That being said, I recently had to replace our Fortigate appliance and at the recommendation of our IT company, I bought a couple Sophos UTM9 115W units. I was really impressed at first glance by the amount of features available in UTM 9, and was originally very excited to get them on-line.
However, this was the first time my IT company was installing a UTM9 device, since they just recently switched from another vendor, so they told me there would be additional time (comped) to cover the learning curve involved.
Well, we have a LOT of time into the configuration (myself and the tech) - maybe 40 hours between the two of us including phone support with Sophos, researching online, reading documentation, etc.. and the current state of the device is.. Many of the features are "somewhat" configured, but end up getting turned off, so my company can function until we figure out each problem (which is proving to be daunting).
I guess I didn't realize there are so many functions that can step on other function or settings that can completely negate other settings, with no alerts, notifications, or prevention in place.. the only output is the feature will just "not work"
I'm I alone in this? or is this someone other people like myself are experiencing?
If I set the unit up one way, logging/reporting works, but doesn't show authenticated user data, so I attempt to sync with AD and run in standard mode with authentication.. which it tells me it was successful, and the web filtering rules appear to be working.. but then logging breaks and it won't show me ANY activity outside of the basic firewall log etc (speaking of the web protection, search engine reporting etc).
I have dynamic DHCP assigned addresses for users who do not authenticate to the AD and need to identify them by MAC address, so I create user definitions, and associate their MAC addresses, and it will either block them completely, or not even recognize them period and treat them with the default policy.
When I test the AD server connection, it return a result of successful, but then all night long I get emails from the device telling me it failed to run a Samba command and is using a cached copy of users/groups.
I have Mac OS X users who can not connect to my servers on the LAN to mount SMB file shares from my Windows server, I've checked the firewall logs for dropped packets, and have opened up ports pertaining to SMB protocol, and have even researched typical SMB ports used and made rules allowing those ports internally.. no dice. If I create a generic rule (for testing) like Internal>any>All, it still doesn't work, the only way it works is by essentially turning the firewall OFF by creating an any>all>any rule, then the Mac's light up, and all their file shares list, everything prints just fine, etc.
This is a nightmare. I have $4,000, and 20+ hours tied up in a little entry level corporate firewall, and nothing is functioning properly...
What am I doing wrong?
Thanks.