This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to allow the traffic to specific IP that Sophos is blocking

For unknown reason, my Sophos XG is blocking specific IPs. Every few minutes, in the log viewer, i see a new denied package. How i can allow the traffic to this IP, and why it is blocked by the firewall ?

This thread was automatically locked due to age.

Parents

0 notapplemaxwindows1 over 5 years ago

Could that be whats app traffic? that's what I'm getting when doing a generic lookup for that IP.

Do you have any web protection turned on? maybe uncheck Enable pharming protection. PROTECT > WEB > GENERAL SETTINGS > expand advanced.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Kal over 5 years ago in reply to notapplemaxwindows1

Tried it, didn't helped. Still seeing denied packages in the log viewer.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to Alex Kal

Those packets do not indicate any problem at all.

I advice customers to disable the logging of Invalid Traffic, because it does not grant useful insights in traffic.

The main question is: Do you have any issues in your network or only does packets?

If only logging is the main concern, disable the logging.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Kal over 5 years ago in reply to LuCar Toni

Hey. Yes, i got some problems. This is outside network, in which i want to connect.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to Alex Kal

Which application causes the issue? What is the network flow?

Because if you log invalid traffic, it most likely means, the application could connect but disconnect for what ever reason. Could be related to the application or could be related to outside network.

RST means, there was a connection and your Client or the Server sends a Reset to kill the connection.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Kal over 5 years ago in reply to LuCar Toni

Hey. There is connection i think, as i can ping that ip from the diagnostics tab. The problem is that GRE protocol is not passing .
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to Alex Kal

You should look at the tcpdump level and try to understand, what is the problem.

https://community.sophos.com/kb/en-us/123567
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LuCar Toni over 5 years ago in reply to Alex Kal

You should look at the tcpdump level and try to understand, what is the problem.

https://community.sophos.com/kb/en-us/123567
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data