IPS blocking even if FW rule says to not

Question

Hi, 
 Firmware : SFOS 17.1.3 MR-3 
 Sophos support are not able to solve issues related to signature 15 (Potentially bad traffic). We are having issues with an Amazon service and Crashplan presently. Not sure if related to Pattern update or recent firmware upgrade. 
 As an example: 
 Crashplan is used to back up a server files to the cloud and IPS is blocking it. So I created a rule (LAN,ANY&shy;&shy;>>WAN,*.crashplan.com) and I set all protections (Scan HTTP, IPS, Web Policy) to "none". The log shows that traffic to this web site go through this new rule but IPS is still blocking it. 
 Am I the only one having issue? 
 Tks

FloSupport · Accepted Answer

Speatech 
 Please take a look at this KBA which has been published for this issue. 
 If you have attempted the instructions outlined in this KBA, please send me a PM with your results. 
 Regards,

Speatech · Answer

Tks for the tips Pascal 
 
 We have created a policy to allow these packets but we are not thrill by this. We are in need to secure our network thoroughly and we are doing the opposite by doing that. It is not the first time that are using a workaround to cover an IPS issue and we starting to have ??? about Sophos IPS. 
 Lets hope they correct the issue soon.

Pascal G · Answer

hehe. So what I had already found out on Sunday. My pleasure ;). Just fun

FloSupport · Answer

Hi l0rdraiden 
 This specific IPS signature has been disabled by default, starting with SFOS v17.1.4 MR-4 due to customers experiencing excessive false-positives. 
 These IPS signatures are triggered by TCP anomalies (includes RST packets received outside of window). This was causing some customers to experience valid RST packets being false-positively dropped. 
 Customers still experiencing excessive false-positives should raise a support case for further investigation. However, this setting can also be disabled via the console command (set ips tcp_option detect_anomalies disable) to allow the TCP anomaly decision to be made by the host client OS instead if desired. 
 Regards,