This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

MALWARE AND CONTENT SCANNING

the course is saying that its recommended to use "Malware and content scanning" instead of "Filtering common web ports" So ive done some testing to check if malware will be blocked if i'll set only "malware and content scanning" unfortunately, files sended with no problem. Ive attached screens from policy of FW rule and ssl/tls rule. Also ive added via Console non-standard port for https and ftp <- but ftp is a different story.

BUT if im setting options below(screenshot) it does working. Tested malware are blocked and i can see it in the LOGS.

This thread was automatically locked due to age.

Parents

0 lferrara over 5 years ago

Roman,

I tried with eicar, and in my case, XG stops the files with both DPI or Proxy mode.

Were yours an update from beta or a new installation?
Cancel
Vote Up 0 Vote Down

Cancel
0 Regex over 5 years ago in reply to lferrara

I was upgrading it from SFOS 17.5.9 MR-9 to 18 ;)

I assume that DPI - you have toggled only thoe options as below ?

6523.Przechwytywanie2.PNG

I have done some testing and Malware is blocked only if the security settings are as below, ive try different options but no luck... Im not sure if it must working as is below. Regarding to courses - i think that not ;)

7870.Przechwytywanie5.PNG
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 5 years ago in reply to Regex

Roman,

the configuration are fine. On my box, malwares are stopped. Can you check that the IPS service is on inside System Services menu?
Cancel
Vote Up 0 Vote Down

Cancel
0 Regex over 5 years ago in reply to lferrara

Yes. IPS service is up and running. ;) I 'll reboot today the fw - you know sometimes it helps :D
Cancel
Vote Up 0 Vote Down

Cancel
0 Badrobot over 5 years ago in reply to Regex

Can you determine if malware is allowed through on HTTP and HTTPS? Or if it is blocked on HTTP but not HTTPS.
Cancel
Vote Up 0 Vote Down

Cancel
0 Regex over 5 years ago in reply to Badrobot

Well, i dont really understand what are you asking for. If im undertstanding you correctly then - My service is working on non-standard HTTPS port(8443) Im not using unencrypted traffic to my server. How i did my testing ? From my PHONE(WAN - PublicIP_LTE) ive lunched an up (QFILE) and uploading a tested malware file, THATS ALL ;) all the rest as metnioned above ^^
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to Regex

The Proxy is only used for Internal to external communication.

You cannot rely on the Proxy for external to internal communication.

For such services, you need a reverse proxy (WAF).

So you need to configure the WAF.
Cancel
Vote Up 0 Vote Down

Cancel
0 Regex over 5 years ago in reply to LuCar Toni

Really a WAF ? 8443 is used for various services in this case im using for a file transfer. Im using DDNS service example: "somename.ddns.myqnapcloud.com" or "somename.ddns.net" all is on port 8443. this port is also used for managment, server is a QNAP DEVICE. ;) If should using WAF can you point for some "hot to" ? ;)
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 5 years ago in reply to Regex

Roman, Luca is correct. Traffic from lan to wan is filtered by proxy. From wan to lan by reverse proxy. This is not a Sophos limitation but how the protocol works.

You can filter and apply Ips filter from lan to wan and viceversa but ips can stop only certain malware.
Cancel
Vote Up 0 Vote Down

Cancel
0 Regex over 5 years ago in reply to lferrara

Really. So you are tring to say im not able to bloc or scan a traffic from WAN to LAN on a specific port ?? I dont wanna to advertised other solution but on FORTIGATE devices it works excelent so "limitations is not cuzed by a protocol" beside that. So why malware is blocked when im not using DPI but only Webproxy and im uploading a file from WAN. ? Cant it be done by WAF ? Sophos XG which im using is for HOME USAGE. So im ok if ssl traffic from will inspected via cert from sophos appliance_CA
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Regex over 5 years ago in reply to lferrara

Really. So you are tring to say im not able to bloc or scan a traffic from WAN to LAN on a specific port ?? I dont wanna to advertised other solution but on FORTIGATE devices it works excelent so "limitations is not cuzed by a protocol" beside that. So why malware is blocked when im not using DPI but only Webproxy and im uploading a file from WAN. ? Cant it be done by WAF ? Sophos XG which im using is for HOME USAGE. So im ok if ssl traffic from will inspected via cert from sophos appliance_CA
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 lferrara over 5 years ago in reply to Regex

Roman on Fortigate you can scan: http, imap,pop3, smtp,smb,ftp and nntp.
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 5 years ago in reply to lferrara

Vote the feature request I opened a couple of years ago:
Cancel
Vote Up 0 Vote Down

Cancel
0 Regex over 5 years ago in reply to lferrara

I can ensure you that not only. ^^ but other then that. Can you also help me with FTPS that isnt scanned by any of sophos engine ? very appreciate fo your spended time for my help :) FTP is setup on FTPS port 990 and im getting error SSL handshake timed out.. for both scanners dpi and webproxy
Cancel
Vote Up 0 Vote Down

Cancel
0 Prism over 5 years ago in reply to Regex

If it is SFTP, you will need to decrypt the traffic first with XG in order to scan it.

Also if you want FTP traffic to be scanned by XG, you will need to run the FTP server over the default port (21). XG is only port agnostic for HTTP traffic, if you run FTP over a non-standard port, It will not detect it as FTP, hence it will not scan it.

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 Regex over 5 years ago in reply to Prism

So if im using ftps on 21 xg will not scan it?
Cancel
Vote Up 0 Vote Down

Cancel
0 Prism over 5 years ago in reply to Regex

No one is able to scan encrypted traffic, if your running FTPS you will need to decrypt it first with SSL/TLS Inspection rules.

Just tested myself with FTPS, XG with the new TLS engine has able to decrypt it and scan over it's default port (990).

NO, I has wrong, XG doesn't scan decrypted FTPS, on v18 your able to decrypt it but not scan it, incredible.
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 5 years ago in reply to Prism

Can someone open a support case?

Of course a license is needed for that.
Cancel
Vote Up 0 Vote Down

Cancel
0 Regex over 5 years ago in reply to Prism

So i have to change the default port to 990. But other then that it will not scan it ;) BUG ?
Cancel
Vote Up 0 Vote Down

Cancel
0 Prism over 5 years ago in reply to Regex

The default port of FTP (Plain-Text) is 21, the default port of FTPS (TLS Encrypted) is 990.

Why XG isn't scanning the decrypted FTPS traffic? I don't know. It probably doesn't support it right now.

It's better for you to wait for a answer from a Sophos Employee.

Roman klisiewicz said:
So i have to change the default port to 990. But other then that it will not scan it ;) BUG ?

XG doesn't recognize FTP or Decrypted FTPS on non-standard ports, if you can, run only on their default ports.

Also the first issue you had with HTTPS traffic not being scanned with DPI - You need to create a Decrypt rule (LAN=>WAN) on the SSL/TLS Inspection tab. Or else it won't decrypt it.

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 5 years ago in reply to Prism

In theory, with the new DPI, http/s traffic on whatever port the traffic is running, it should be decrypted.

Here we are talking about FTPS service, which uses TLS but the service is FTP and not HTTP/S.

Michael Dunn could you clarify?

Thanks
Cancel
Vote Up 0 Vote Down

Cancel