WAF Status "Unregistered"

Hi,

Unregistered is just "Unconfigured". 

So maybe you miss some step in the config. 

https://community.sophos.com/kb/en-us/126470

In that case, maybe I've mistaken symptom for cause.

I'm unable to follow the guide that you've linked to.  Step 1 works successfully "Configure the Web Server", but step 2 fails "Configure a Business Application Rule".

I have successfully created Business Application Rules for SMTP traffic (inbound and outbound), but as soon as I create a new Business Application Rule, and select any of the WAF Based Templates, the interface freezes and I'm unable to complete the rule.  I just get a the spinning cursor in the middle of the screen.

Not sure what screenshots would be useful, but I've taken a few different ones.

Firstly, the System Services Screen:

Secondly, the webservers I've defined:

Next, the initial screen of adding a Business Application Rule:

This works successfully if choosing an SMTP rule, or a full DNAT Rule:

But fails when choosing any of the WAF-based rules (shown here with a plain Web Server Protection Rule, but also applies to the built-in Exchange rules):

(This is a composite of several screenshots)

I was getting the same thing with my software version of XG Firewall Home.  After getting nowhere for weeks on this issue.  I opted to buy an XG 85 thinking that I wouldn't have the same problem.  I was wrong.  Now I'm getting the same problem with the XF appliance as well.  The exact same symptoms.

Have you found a way around it?  Is it possible to create Business Application Rules from the advanced console or anything?

For me, this fault makes the XG firewall not fit for purpose

Still unsure how this can happen. 

Can you select the profile after deleting everything in the WAF Section? 

So basically delete all kind of Real Server configuration. 

And show me please all you Interfaces and your Certificates. Did you upload some kind of certificates? 

I've deleted all the 'Real' webserver objects created under Protect -> Web Server -> Web Servers, so there are no servers listed.  Unfortunately, I still get the same results when trying to create the Business Rule.

The image below shows the interfaces on the device.  PortA is my Internal LAN where clients (and the servers I was to reverse proxy traffic to) are, PortB is the Internet facing interface where traffic will come into.

In terms of certificates, I have set up HTTPS decryption and scanning, which is working correctly.  The certificate for this was generated from the XG as a CSR, then requested from the Active Directory CA.  It has also been set up to trust the Internal CA.

Gary Burch1 said:

I have successfully created Business Application Rules for SMTP traffic (inbound and outbound), but as soon as I create a new Business Application Rule, and select any of the WAF Based Templates, the interface freezes and I'm unable to complete the rule.  I just get a the spinning cursor in the middle of the screen.

This is a known problem caused by a certificate not being properly imported.

You can try to fix this by deleting any certificates that you imported and then import them again.

If you try this workaround, please report back if it helped.

In case you want to get in contact with Support about this, you can refer them to NC-35682 (unresponsive UI) and NC-35929 (certificate import problem).

ewadie said:

This is a known problem caused by a certificate not being properly imported.

You can try to fix this by deleting any certificates that you imported and then import them again.

Thanks for this, is there anything I need to do to ensure that the certificate is imported properly next time?

Gary Burch1 said:

Thanks for this, is there anything I need to do to ensure that the certificate is imported properly next time?

The specifics of this problem are still unclear. For now just delete your certificates and import them again.

I gave up on the XG Firewall Home Edition (software) and purchased an XG 85.  I can create my Exchange General BAR now except the imported certificates are not showing.  I have a separate support inquiry open for that one.

Brian Ladley

ewadie said:

This is a known problem caused by a certificate not being properly imported.

You can try to fix this by deleting any certificates that you imported and then import them again.

If you try this workaround, please report back if it helped.

Removing certificates proved to be somewhat problematic, as many of them were in use and therefore couldn't actually be removed.  So, given that my XG firewall is not yet providing a live service, I decided to perform a factory reset so that I was starting from a 'clean state'.

I can confirm, that I was able to create a Business Application rule successfully using the "Exchange Server General" template early on in the configuration of the new firewall.  I then imported the HTTPS Certificate including the private key for the Exchange Servers.  I also exported the certs (public keys only) of the root and signing CA which created the Exchange HTTPS certs, and imported them.  I also generated a new cert for the device so that I could log onto it without getting a certificate warning.

For some reason, on the certificates screen the new certs are still showing as untrusted, and I'm not able to select them for the business application rule, or the the Web interface certificate.  At this point, I decided to test if I could create a new WAF Business Application rule, and discovered that the same error occurred as before.

So, I've decided that given this issue and a number of other minor issues I've had in testing the XG firewall that it's not ready for prime time usage yet, so I'm rolling everything I'd been testing under it back to my UTM 9 box instead.  It's a shame really, there's a lot of features in XG that look really useful, but without the basic functionality being in place it's not much use.  I'll probably keep an eye out and test XG again after the next version is released.

TL;DR - After a factory reset, I was able to create the rule.  But then re-creating all the config I require caused the same error again.

ewadie said:

This is a known problem caused by a certificate not being properly imported.

You can try to fix this by deleting any certificates that you imported and then import them again.

If you try this workaround, please report back if it helped.

Removing certificates proved to be somewhat problematic, as many of them were in use and therefore couldn't actually be removed.  So, given that my XG firewall is not yet providing a live service, I decided to perform a factory reset so that I was starting from a 'clean state'.

I can confirm, that I was able to create a Business Application rule successfully using the "Exchange Server General" template early on in the configuration of the new firewall.  I then imported the HTTPS Certificate including the private key for the Exchange Servers.  I also exported the certs (public keys only) of the root and signing CA which created the Exchange HTTPS certs, and imported them.  I also generated a new cert for the device so that I could log onto it without getting a certificate warning.

For some reason, on the certificates screen the new certs are still showing as untrusted, and I'm not able to select them for the business application rule, or the the Web interface certificate.  At this point, I decided to test if I could create a new WAF Business Application rule, and discovered that the same error occurred as before.

So, I've decided that given this issue and a number of other minor issues I've had in testing the XG firewall that it's not ready for prime time usage yet, so I'm rolling everything I'd been testing under it back to my UTM 9 box instead.  It's a shame really, there's a lot of features in XG that look really useful, but without the basic functionality being in place it's not much use.  I'll probably keep an eye out and test XG again after the next version is released.

TL;DR - After a factory reset, I was able to create the rule.  But then re-creating all the config I require caused the same error again.

Hi,

as far as i can tell, there seems to be something wrong with the HTTPs certificate, you are trying to use for WAF. 

But the support should be able to troubleshoot this. 

To follow up:

This KBA has been created for this situation.

I found that the problem with the certificates seemed to be caused by importing certs without their private keys.  My Webmail certificate was a GoDaddy cert which did not seem to let me get the private key separately.  I wound up exporting the certificate from my Exchange Server and included the private key with the export.  This time when it imported, it became available for use with the Exchange General BAR.  The firewall rule is finally configured.  Now I just have to figure out why it's still blocking the ports needed for the OWA and Autodiscover connections.