Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 17 replies
  • Subscribers 30 subscribers
  • Views 23554 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Lutron Caseta and Apple home/Siri issues after installation of Sophos home

dfoolio

Hello,

I recently configured a Sophos XG home device for use and it has been working great, except for one issue (so far):

Siri doesn't seem to work correctly with our at home setup. We have a Lutron Caseta smart lighting system throughout the home, that device is plugged into a switch into Port 1. Port 3 is bridged to LAN which is our Sophos AP 55c. I do have 'Enable routing on this bridge pair' enabled.

My Wireless devices Apple Home Pod/iPhones/Apple Watch/MacBook/etc. are having difficulty communicating with the Lutron Caseta. Normally. I should be able to say "Hey Siri, turn on the kitchen lights" and it's done pretty instantly. However, intermittently, this works and doesn't work since I got the Sophos XG configured. Meaning, Siri responds "cannot communicate with devices"

I am able to access the Lutron Caseta at all times (even when Siri is not working) with the Lutron app. When I check the Apple home app (which I should be able to control all the lights with on my phone) during Siri not working, the buttons all say "Updating" and I cannot access the light switches.

That being said, I have a LAN > LAN rule configured with Any / Any using any services. Would it be wiser to configure a Lan > Lan Port 1 / Port 3?

Additionally, I did a packet capture & checked the firewall logs between the Lutron device and my iPhone using Siri and saw the following

I did some research and am aware that Invalid_traffic with no header seems to be dropped and this is normal for logging, however, when i've taken packet captures and Siri is working, I don't see any invalid_packet drops.

What other troubleshooting can I do? Does anyone else have issues with at home apple devices? Is there something additional I need to configure? Any assistance is greatly appreciated, the Sophos community is great and I thank you for any help.

 

Some additional information:

Firmware version: SFOS 17.1.2 MR-2

I have IPS enabled, Country blocking, and HTTP Malware scanning (not configured HTTPS, yet) but that's to WAN (Screen shot of firewall rules below)

Also, if you guys catch anything maybe I didn't setup (I regard myself as novice > intermediate with networking) please let me know.



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    I am not sure why you have a default rule that allows all traffic out, really defeats the purpose of the rules above it?

    You appear to be trying to limit your kids access to the internet, but you allow all traffic from their devices and if they have figured out how to change the IP address of their devices the traffic will go out the default rule at the bottom.

    What exactly are you trying to achieve with your rules?

    Ian

  • 0 in reply to rfcat_vk

    rfcat_vk said:

    Hi,

    I am not sure why you have a default rule that allows all traffic out, really defeats the purpose of the rules above it?

    You appear to be trying to limit your kids access to the internet, but you allow all traffic from their devices and if they have figured out how to change the IP address of their devices the traffic will go out the default rule at the bottom.

    What exactly are you trying to achieve with your rules?

    Ian

     

    The default rule created was allowing all traffic out, i've restricted it just to the internet LAN subnet. I'm going to start tweaking this a bit, but I guess I don't have the greatest understanding the configuration as I have it set up. I am trying to learn it. Any help would be appreciated, or suggestions. I generally learn through doing in real time best.

    thank you for taking the time to respond

Reply
  • 0 in reply to rfcat_vk

    rfcat_vk said:

    Hi,

    I am not sure why you have a default rule that allows all traffic out, really defeats the purpose of the rules above it?

    You appear to be trying to limit your kids access to the internet, but you allow all traffic from their devices and if they have figured out how to change the IP address of their devices the traffic will go out the default rule at the bottom.

    What exactly are you trying to achieve with your rules?

    Ian

     

    The default rule created was allowing all traffic out, i've restricted it just to the internet LAN subnet. I'm going to start tweaking this a bit, but I guess I don't have the greatest understanding the configuration as I have it set up. I am trying to learn it. Any help would be appreciated, or suggestions. I generally learn through doing in real time best.

    thank you for taking the time to respond

Children
No Data