v18: Bug with data counting in firewall rules?

Hi cryptochrome, 

Could you please share the screenshot of the firewall rule that shows data in and out counters? I will verify if it should be like that or not and update you.

Thanks,

Hi cryptochrome, 

Could you please share the screenshot of the firewall rule that shows data in and out counters? I will verify if it should be like that or not and update you.

Thanks,

Sure, here you go:

Firewall Rule:

Corresponding NAT rule:

Firewall Rule Details:

Note that this is just one example. I am seeing the same "reversed" counter on other incoming rules. 

How do you count the data? If someone on the internet initiates the connection and transfers a lot of data, does that count as incoming or outgoing?

Prism said:

Also, genuine question, Why data counting directly on the rule in XG is so important for you? What's the best use-case scenario for it?
Isn't it better to just use the Logs/Reporting function that already exists? I know both of them are bad compared to the competitors, but at least it "works".

The thing is, it's not important to me at all :-)  When I opened this thread, I never expected a huge discussion like this. I just noticed the counters on my incoming rules were wrong and opened a post, thinking it may be a bug. And now here we are, haha. 

I also don't care whether the counters are displayed right in the rule or whether I have to open a different view for it (reports, logs, whatever). It doesn't really matter. The whole point is: the counters that are there are wrong. Sending data out of the WAN interface and showing that as incoming traffic is just plain crazy :)

Prism said:

They don't show it like XG.

Well... they do, actually. Some even directly in the rule (Fortinet), some others require a few additional mouse clicks, but the data is available. With proper directional display. 

Prism said:

Also after after 40 replies over this thread,Isn't it better to XG follow the industry standard and also use hit counters for the rules instead of just showing bandwidth, also please, show when the rule has first and last used.

I would second this request. It would be very helpful in housekeeping scenarios. 

Also, since you guys keep mentioning XG reports and that the data is available there as well, I just took a look. I clicked on an application in the traffic dashboard and immediately had to laugh out loud and hard. Like if this would make any sense whatsoever:

Mind you, this is for one application. It tells me the source and destination zones had the exact same amount of hits and data, which of course is utter nonsense. Another pointer at just how wrong Sophos calculate data. 

People have been complaining about XG reports and logs since it came out.

That's why I wrote: (but at least it "works".)

I'm a optimistic person; But only god knows when the devs will do something about this.

I hope the best for v18.5, so no one have to complain about this anymore.

Would recommend to check Central Reporting. 

https://community.sophos.com/products/xg-firewall/sfos-eap/central-firewall-reporting-eap/

Central Reporting is waiting for Feedback from the community. 

You can simply activate it in Central (EAP). 

Well, I completely forgot about this.

Will be checking it out right now.

Thanks!

That looks interesting. Does this require additional licensing? Or is it part of the XG license?

https://www.sophos.com/en-us/medialibrary/PDFs/partners/whats-in-the-central-firewall-reporting-eap.pdf

Licensing Collecting, storing, and aggregating firewall logs naturally requires compute and storage resources in the data platform. For the EAP, we are providing administrators with a rolling seven days of log retention and reporting data per firewall, at no cost. Additional details will be made available later regarding the licensing options for CFR, which will include both free and premium licensed capabilities.

As mentioned, they are waiting for Feedback about their new product in Central (Called CFR). 

There are some more option for reporting. 

I am using CFR and it does not add useful reporting at all. Sorry Luca but XG reporting is very bad. Please consider me to improve the reporting. Reporting and logging have the same problem: understand what is happening is very time consuming! Utm 9 has better reporting far away. I open privately for discussion.

Regards

Hi Guys

I'm going to bookmark this thread so when I come to discuss the traffic counters with a customer I have some reference material to work through rather than using intuition. Thanks for all the helpful comments.

Hi All,

Thank you for sharing your feedback regarding this topic. I'll forward these over to the Product Team for their consideration.

Thanks LuCar Toni for your explanation and recommendations.

Hi All,

Thank you for sharing your feedback regarding this topic. I'll forward these over to the Product Team for their consideration.

Thanks LuCar Toni for your explanation and recommendations.