KBA 135412 - access to User/admin Portal - Local service ACL exceptions are not working

You can do this with Local ACL Rules in XG.

community.sophos.com/.../132814

Here's an example:

1) Allow LAN.

2) Allow Brazil.

3) Drop everyone else.

Thank you

Tested it and still can access the  user portal from a different country which is blocked in ACL

How does the ACL Rules position looks like?

It follows the same standard as Firewall Rules, from top to bottom.

Here It's working. (Port 4433 = User Portal.)

Closed on anyone that isn't located in Brazil.

Aberta = Open in Portuguese.

This rule is on the top of the ACL rules

Hello lukg,

I think that #PortA1 is by default internal LAN zone port, isn't? Remove this port and add WAN zone port and the rule will work well, i think.

Regards

alda

I have tried as well external IP address where the user portal is located with the same result

I have tried as well external IP address where the user portal is located with the same result

I have done more test and it looks that ACL exception rules are not applying either in allow or denied direction, will report as a case to Sophos

I have the same problem.

Please log case with support and share outcome with us, I'm waiting for Sophos support to reply, I just wonder for how many  XGs these ACL exceptions are not working but people will assume that they work

Hi lukg and shando1987,

Could you please share your support case numbers with me so that I can follow up?

Thanks,

Hello,

My case ID is 9846646.

Hi there,

Thank you for providing the service request number.

Hi there,

I have checked the service request number and the engineer has asked certain details, please respond to the email so that they can contact you further to troubleshoot the issue.

Hi Keyur,

I've responded to the email.

Hi there,

I have informed the support engineer to contact you as soon as possible, thank you for your patience.

Hi All,

This Local ACL exception issue is related to the ID NC-58339:

• For devices on SFOS v17.5 MR10 - Local ACL Exceptions will not work if there is an Any-Any Drop Firewall rule configured.

This will behavior will be corrected in an upcoming firmware release.

Regards,