Unidentified User

Hi,

you have chosen one report to look at. Please login to the GUI and review the diagnostics - reports or the report section or even the log viewer.

Some of these will show you the IP address of the device with the large download.

Please post your firewall rules because the issue might be you are allowing your XG to be a internet relay?

Ian

 Thank you for your help, I have different reports and also checked log, but could not figure it out. Here is my firewall rules.

Hi myb,

Are you using authentication with local account or integrate 3rd service? Can you show authentication configure (authentication server, authentication service,...)

Hi myb,

Are you using authentication with local account or integrate 3rd service? Can you show authentication configure (authentication server, authentication service,...)

I use only local method with captive portal.

Rule's ID 9, please delete. This rule allow all traffic and don't match user.

OK, but don't match user in which rule?

Hi,

you need to delete rule 9 as posted above or tighten user access to rule 9.

You are only blocking p2p, not proxies. 

Ian

Because all of traffic is passed by this rule. Traffic don't go through rule 2 which rule use match known user. Traffic is inspected from top to bottom of firewall rule list. If you want to use web protection feature, you can configure in rule 2 and delete rule 9.