This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos blocking .net download from microsoft with rule 0

So sophos is currently blocking .net downloads. This is a feature update that you can install by going to control panel -> programs -> windows features -> .net 2.0 and 3.5

You click the little button there and it offers to download. I am not able to determine what exactly is blocking this. Basically, it says its being blocked by rule 0, which as i have learned from another forums post, is a default block.

So how do i work around this? For now, i can just run the following command to install the feature from ISO, but there is no reason that we should ever be blocking microsoft!

DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:d:\sources\sxs

I can see it being blocked in the firewall log. I have checked all the other logs and nothing is being blocked in any of them. I have disabled all technologies on the firewall rule "rule 8" which normally governs this connection. However it says they are all blocked by rule 0. How do i work around this since i cant even see rule ID 0....

stuck.

Ill probably create a case about it too if no one gets back to me.

----

EDIT: had a helluva time uploading one of these screen shots. Seems like your forums software does not like the word "shi z" and was rendering the word in the name as asterisks, thus creating broken links. hilarious job sophos!

This thread was automatically locked due to age.

0 LuCar Toni over 6 years ago

Your Invalid Traffic is not default drop. It is basically something like "hey i do not want to continue this communication".

https://community.sophos.com/kb/en-us/131754

Do you use HTTPs Inspection?
Cancel
Vote Up 0 Vote Down

Cancel
0 givemecontrol over 6 years ago in reply to LuCar Toni

yes but i turned all that off on the rule this machine falls under. I turned everything off to test and still cannot establish the connection.

so scan http, decrypt and scan https, web policy, application control, all turned off. I didnt turn off intrusion protection though.. i guess i should try that, but ill have to find another machine with the issue as i had to fix it this am by manual command to get it going for the user.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 6 years ago in reply to givemecontrol

Would assume to try the connection without IPS enabled.

Most likely, the IPS drops something, your client will send some Reset / Finish packets. Would fit together with the rule 0 drops.
Cancel
Vote Up 0 Vote Down

Cancel
0 givemecontrol over 6 years ago in reply to LuCar Toni

i cant reproduce right now as i need to have another client to test and i dont have one. need to build a vm to test next week. i didnt see anything regarding the ip in the IPS logs though.
Cancel
Vote Up 0 Vote Down

Cancel
0 givemecontrol over 6 years ago in reply to givemecontrol

i built a vm from scratch and i can no longer reproduce... either it was a one time thing on one particular machine or sophos has updated their definitions to fix this. either way it no longer seems to be an issue...
Cancel
Vote Up 0 Vote Down

Cancel