NGFW v15.1.0 available!

NGFW v15.1.0 is now available and is a major new release based on Debian 10.

You can read about the changes here:
http://wiki.untangle.com/index.php/15.1.0_Changelog

You can see it in action here:
http://demo.untangle.com/

The ISOs and IMGs and firmwares can be downloaded here:

untangle-15.1.0-amd64.iso
untangle-15.1.0-amd64.img
untangle-15.1.0-amd64.ova

Enjoy!

Notice: 32 bit installer has been EOL. Existing 32 bit systems will upgrade. Backups from 32 bit will also restore on 64 bit installs.

When will the upgrade be available for me?
Upgrades are rolled out over time to the existing servers. If you want the upgrade immediately, email your box UID to support and request adding your UID to the Early Upgrade List.


Does the upgrade require a reboot?
The upgrade will reboot automatically at the end since a new kernel is included with this release.

Did a full upgrade and reinstall. 15.1 (buster) operates is much smoother on the i7 7th gen processor then 15.0 (stretch). Upgrade was pretty easy. Don't be scared to do a full reformat and install :)

Quote:

---

Originally Posted by flynhawaiian

Did a full upgrade and reinstall. 15.1 (buster) operates is much smoother on the i7 7th gen processor then 15.0 (stretch). Upgrade was pretty easy. Don't be scared to do a full reformat and install :)

---

Good to hear. In what way(s) is it smoother?

The web interface doesn’t seem to as slow. Restarts don’t lock up the computer. Just feels more refined. Only time will tell, but I’m pretty happy. The install was also pretty easy; wish there was a way during the install you could connect to your google drive to download the previous configuration; rather than making a temporary configuration for the network ports.

Home user ... smooth upgrade from 15.0 to 15.1
All appears to be working as expected.

Looks like Suricata was updated, too? I don't see it in the changelog. I believe 15.0 was on 3.2.1 and now it's 4.1.2? Could be useful to include in the notes unless I'm taking crazy pills. :lol

Of course it was, Untangle went from being based on Debian 9 to Debian 10. All packages in the Debian world went through the same lurch. So, if you want to go look at the changelog of Debian 10, you may as well add it to the list here.

Debian 9 release: 2017, June 17
Debian 10 release: 2019, July 6

The hardware released during that window is substantial, so yes... modern platforms are going to see a distinct quality improvement. For Intel specifically this means proper support for 8th and 9th generation CPUs, something Debian 9 utterly lacked. The 7th generation released a few months before Debian 9, so we've had decent support for it all along, but there were still a few snags. I didn't like operating Debian 9 on anything younger than a 5th gen.

Untangle still lacks EFI support though... which is a bit of a pain.

"Untangle still lacks EFI support though... which is a bit of a pain. "

Maybe now that they have the main parts working they can start working on all the things that have been waiting for so long. Like efi, ipv6, ...

https://untanglengfirewall.featureupvote.com/

Quote:

---

Originally Posted by WookieeSasquatch

Looks like Suricata was updated, too? I don't see it in the changelog. I believe 15.0 was on 3.2.1 and now it's 4.1.2? Could be useful to include in the notes unless I'm taking crazy pills. :lol

---

We don't list all the updates in 15.1 which are part of the Debian 9 to 10 upgrade. All of the Debian improvements from 9 to 10 are in the Untangle v15.1.

Quote:

---

Originally Posted by jcoffin

We don't list all the updates in 15.1 which are part of the Debian 9 to 10 upgrade. All of the Debian improvements from 9 to 10 are in the Untangle v15.1.

---

Thanks for the clarification! This is my first rodeo of diving into the weeds of Untangle.

My system updated overnight. I rebooted it this morning although it may have already done so during the upgrade. Everything went smoothly and seems to work well. Good job Untangle! Thanks!

Oh shame i was looking forward to efi support which i thought would be available with debian 10?

Any ideas which release would support it?

Quote:

---

Originally Posted by kkw98

Oh shame i was looking forward to efi support which i thought would be available with debian 10?

Any ideas which release would support it?

---

We are building the installer which is the missing piece of UEFI as we have to customize the installer. Set for 16.0.

Do I need to hook up a monitor/keyboard to the Untangle device to select the new kernel after reboot? I remember doing something like that for a previous kernel upgrade.

Quote:

---

Originally Posted by ctaranto

Do I need to hook up a monitor/keyboard to the Untangle device to select the new kernel after reboot? I remember doing something like that for a previous kernel upgrade.

---

No, the upgrade automatically selects the new kernel.

How long after upgrade to 15.1 until web interface is available? I can access the internet fine but there's no web UI login screen. I am hesitant to reboot the appliance.

I have two suggestions, but I think the first is: clear the browser cache. <ctrl> F5 should do, but you might need to be more aggressive.

sometimes you can see what is going on by hitting <Esc>

Quote:

---

Originally Posted by miles267

How long after upgrade to 15.1 until web interface is available? I can access the internet fine but there's no web UI login screen. I am hesitant to reboot the appliance.

---

It depends on the CPU and database size. An i3 with ~400G DB on a 7200rpm HD took nearly an hour to complete. As Jim points out, the common issue is local PC browser caching. Try a different browser or private browser instance to break the cache.

OK. It's an i5 machine. I have waited for prob 2-3 hrs already without success. Different browsers and cache clearing didn't resolve. However internet access hasn't been interrupted. Shall I let it keep running or restart it?

Quote:

---

Originally Posted by miles267

Shall I let it keep running or restart it?

---

DM me your UID and I will check.

Thanks jcoffin have just DM'd.

Quote:

---

Originally Posted by miles267

Thanks jcoffin have just DM'd.

---

Was this modified with Let's Encrypt? There is an error with apache starting. The upgrade is complete though. I would open a support ticket since this is an upgrade and we will want to look at it more.

I've migrated my Untangle (15.0.0) 3 days ago from a physical box to a a VM, and running on same box (Intel Celeron CPU 3865U machine, 16GB RAM).

Yesterday Untangle was automatically updated to 15.1.0.

My network seems to run faster - from the Untangle Web interface to web browsing with SSL inspection. So great job guys!

Quote:

---

Originally Posted by jcoffin

Was this modified with Let's Encrypt? There is an error with apache starting. The upgrade is complete though. I would open a support ticket since this is an upgrade and we will want to look at it more.

---

Not modified with Let's Encrypt. Will open ticket. Thanks.

I installed Beta 2 when it came out a week or so back. It is build:

15.1.0.20200424T172944.3a26d5aa95-1buster

What is the build of the release version? I do Upgrade, but the system says there is not one available.

From the iso install.
Build: 15.1.0.20200412T101437.6945ed11c2-1buster This is wrong! See below.
Kernel: 4.19.0-8-untangle-amd64

I assume the upgrade will follow the usual roll out scheme.
https://forums.untangle.com/feedback...tml#post241952

Is there a way to force the upgrade? When I check for updates is says that none are available

Thanks,

Chris

Quote:

---

Originally Posted by Chewy

Is there a way to force the upgrade? When I check for updates is says that none are available

---

Email your UID to support and they can put you on the priority list. You should see the upgrade ~ 24 hrs.

Quote:

---

Originally Posted by theoak

What is the build of the release version? I do Upgrade, but the system says there is not one available.

---

Release version of 15.1 is Build: 15.1.0.20200518T072405.9cd79df59a-1buster

Quote:

---

Originally Posted by miles267

Not modified with Let's Encrypt. Will open ticket. Thanks.

---

Thanks for opening the support ticket on this issue. It seems Debian is requiring a higher encryption level for Apache. We will roll out a fix shortly. https://jira.untangle.com/browse/NGFW-13096

Quote:

---

Originally Posted by donhwyo

From the iso install.
Build: 15.1.0.20200412T101437.6945ed11c2-1buster
Kernel: 4.19.0-8-untangle-amd64

I assume the upgrade will follow the usual roll out scheme.
https://forums.untangle.com/feedback...tml#post241952

---

I downloaded from the link within a couple minutes of your original post. So maybe it wasn't uploaded yet. This shows the need to not reuse names and also provide check sums to verify the validity of the download.

Quote:

---

Originally Posted by donhwyo

I downloaded from the link within a couple minutes of your original post. So maybe it wasn't uploaded yet. This shows the need to not reuse names and also provide check sums to verify the validity of the download.

---

With browser and ISP cache, it is a gambit. If you wish for MD5, log into Command Center to download.

Attachment 10173

Update inbound:

https://wiki.untangle.com/index.php/...ld2_2020-05-21

New Build: 15.1.0.20200520T115448.b25694768b-1buster

As a new Untangle user - I find it strange that the following happens:

1. E-Mail Update available...
2. Command Center Update available...
3. Forum Update available...
---
4. Untangle Software [No Update!] <- :D

What happens if the software is breached in a way, would a update to all devices take as long over the update services?
[Sophos SQL Injection on the Sophos XG Software] <- Just an example!

-----
Not to sound ungreatfull and such but would suggest to make a major announcement if it is available for everyone. (Over all Services) ;)

Best regards
Val.

Quote:

---

Originally Posted by Valvaris

-----
Not to sound ungreatfull and such but would suggest to make a major announcement if it is available for everyone. (Over all Services)

---

As said in...

Quote:

---

Originally Posted by jcoffin

When will the upgrade be available for me?
Upgrades are rolled out over time to the existing servers. If you want the upgrade immediately, email your box UID to support and request adding your UID to the Early Upgrade List.

---

That is not really a solution to my question. I know about the UID E-Mail Upgrade. ;)

This upgrade is actually like a major release by itself coz of Debian Buster - So it is more impactful then just a Hotfix.

The point I want to get at is that like said before:

Quote:

---

1. E-Mail Update available...
2. Command Center Update available...
3. Forum Update available...
---
4. Untangle Software [No Update!] <-

---

And if so plz mention a time frame - To be honest I was afraid to miss out on the upgrade coz of essental fixes to the OS.

Sincerely
Val.

[P.S. ---> Just a suggestion!]

Quote:

---

Originally Posted by Valvaris

As a new Untangle user - I find it strange that the following happens:

1. E-Mail Update available...
2. Command Center Update available...
3. Forum Update available...
---
4. Untangle Software [No Update!] <- :D

What happens if the software is breached in a way, would a update to all devices take as long over the update services?
[Sophos SQL Injection on the Sophos XG Software] <- Just an example!

-----
Not to sound ungreatfull and such but would suggest to make a major announcement if it is available for everyone. (Over all Services) ;)

Best regards
Val.

---

I think that sense of strangeness is legitimate, but nevertheless a seemingly fixed part of the Untangle experience. But this experience is related only to major releases and point releases and not necessarily builds, which can get pushed out fairly quickly, so there are generally no security concerns.

The updates are pushed out in an apparently pseudorandom way so other than generalizations like "over time" or "by the end of [month]" there is no timeframe. That means the public announcements target clean installations, not upgraded installations. For upgrades, it’s a heads up.

And for myself, I use the announcement to decide if I want automatic update on or off during that period. If I have any interest in being involved in the update, I turn automatic update off until I’m (and it’s) ready.

Now, for me the biggest pain of all this is the fragmentation of the support community here that necessarily follows from the upgrade process, between the haves and the have nots, across a nontrivial amount of time per year.

Yeah, but considering there was a substantial SSL issue found and fixed in v15.1 already, that broke web admin on some boxes...

Well let's just say I'm rather happy with staged updates, they do have their advantages.

It's also important to consider, that Microsoft, Apple, and Google ALSO stage their updates. Bandwidth might be infinite, but in the moment it's annoyingly finite. So spreading out the entire user base over a month or two is the only reasonable way to push all this software out.

The notification message sent via email does say:

Quote:

---

We will roll out this update to current Untangle NG Firewall customers with automatic updates turned on over the next several weeks.

---

The forum thread has something similar in it. So it's not like this reality is hidden, but the specifics of how things roll out... well that's in the email too: https://support.untangle.com/hc/en-u...w-do-I-get-it-

I'm not sure how Untangle can be more forthright here... but new users still go through this sort of a culture shock because they assume for some reason that upgrades should be infinitely available for all users at launch. Untangle isn't Valve... And this software is buckets more important than a video game or a movie... so the roll out must by necessity be handed with greater deliberation and care.

Could you imagine a bad update that bricked installs? Networks down all over the place? *shudder* I'm glad Untangle is cautious, they aren't as cautious as I am... but still much easier to work with Untangle than Microsoft, Google, or Apple in this regard. Though, I do want to take a shower after admitting that defines my standard on the subject.

Quote:

---

Originally Posted by sky-knight

It's also important to consider, that Microsoft, Apple, and Google ALSO stage their updates.

---

I'm not sure that's really comparable. If Apple announces that macOS Pickled Bologna will be available September 24, and if I want it, I just hit the Store and download it. If Apple Announces iPadOS 1313 will be available Friday, August 13, I don't have to wait for the notification that the update is available.

The only other time I had wait for an OS upgrade in terms of weeks or more was when upgrading Atari OS ROMs.

I agree that Untangle are completely transparent about this. But I think it's completely fair to say that Untangle marketing can catch new users understandably flat-footed.

If you want the update now you can get it. Backup your current settings. Download the iso and install. Restore your settings. Done! For bonus points get another hard drive so you can fall back easily.

Just because you know your are paranoid doesn't mean they are not after you.