Sophos Firewall

Discussions Advanced threat protection exception not working

Sophos Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 5 replies
Subscribers 27 subscribers
Views 2941 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Advanced threat protection exception not working

l0rdraiden over 6 years ago

I have configure the exceptions like this

And is being blocked anyway by ATP

Any idea why?

This thread was automatically locked due to age.

0 rfcat_vk over 6 years ago

From my testing you will also need an IPS exception. The site is classified as unfriendly.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 l0rdraiden over 6 years ago in reply to rfcat_vk

Do you mean a firewall rule to that domain with IPS disable?
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to l0rdraiden

No, an IPS in policies..

You will need to build a new IPS policy.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 l0rdraiden over 6 years ago in reply to rfcat_vk

Now I have this exceptions like this

IPS exception like this applied

And now I get DNS requests blocked

IPS seems to be working, but in ATP if i don't use the source IP it looks like the tread exception field is not working properly.

In any case I consider this a bug, since it is an inconsistency, If I whitelist something in ATP I wouldn't expect to see it blocked in the ATP log, if it is an IPS event then it should appear in the IPS log.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to l0rdraiden

Your log is showing it is being blocked by IPS not ATP.

Application and IPS work hand in hand otherwise you do not get the classification.

If you think it is a bug, raise a support case.

Ian
Cancel
Vote Up 0 Vote Down

Cancel