This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG PCI compliance

We just installed a new XG 115 for a client of ours that had a ~15 old Cisco ASA and was failing PCI compliance scans due to firmware updates not being available. Now that we have installed this new UTM, I re-ran the scans. Unfortunately, the scan failed citing "The remote host does not discard TCP SYN packets that have the FIN flag set. Depending on the kind of firewall you are using, an attacker may use this flaw to bypass its rules". The suggested 'fix' is to update the appliance, but it is already up-to-date. I need to figure out how to fix this because I am going to have a hard time explaining why their new UTM isn't passing scans! Ideas?

This thread was automatically locked due to age.

Parents

0 AADD over 7 years ago

What "Device Access" options are enabled on the Zone you are testing? My thinking being that User Portal or Console access is active on the IP's being tested.
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul Schwegler over 7 years ago in reply to AADD

The only things enabled on the WAN were the user portal and SSL VPN. We use neither so I disabled them.

Then, I realized that the Sophos is behind a Centurylink Modem. I fear this port scan is catching something wrong with the modem. I put the Sophos in the modem's DMZ and will see if the scan passes. If that doesn't work, I'll have to put the modem in bridge mode and let the Sophos handle PPPoE. Ah, the joys of small office networking /s
Cancel
Vote Up 0 Vote Down

Cancel
0 AADD over 7 years ago in reply to Paul Schwegler

Paul,

What was the outcome?
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul Schwegler over 7 years ago in reply to AADD

Still failing. The next step will be to put the modem into bridge mode to keep it from interfering with the scan.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Paul Schwegler over 7 years ago in reply to AADD

Still failing. The next step will be to put the modem into bridge mode to keep it from interfering with the scan.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Bill Roland over 7 years ago in reply to Paul Schwegler

I don't have anything to add except that, at least for the people who do our PCI scanning, we're required to whitelist their IP's so the scanners get a clean crack at us. Apparently IPS/IDS can detect the scan as an attack and just block everything from the scanner, but that paradoxically results in a "failure" scan since the scanner cannot complete its survey.

If you have RED enabled, you'll get dinged for weak ciphers unless something has recently changed.
Cancel
Vote Up 0 Vote Down

Cancel
0 Paul Schwegler over 7 years ago in reply to Bill Roland

I did initially whitelist their IPs but disabled that in troubleshooting. I scheduled a scan to run yesterday, and it is still pending, I will update when I know if this worked or not.
Cancel
Vote Up 0 Vote Down

Cancel