exchange server via activeSync

Hi Antonio Rouqueiro.,

Could you please provide protection policy detail, reverse-proxy logs, and source public IP address via PM for further investigation.

Thanks,

- Is there any update on this issue?  

Sorry, I think that was the other poster that initially had this problem as I did not provide you any log files.  Please let me know how I would go about doing so and I will.

Hi AllanD 

Please follow KBA Sophos XG Firewall: Where to find log files? and provide reverseproxy.log and public source IP address. 

Thanks,

PM'd you the logs.  Looks like something in the "Exchange General" protection policy, under the Common Threats filter is blocking based on size.  Which is odd since there isn't and size limits in there.  But sure enough turning off the common threats filter lets the attachments work just fine.

Have there been any fixes for this issue? I'm having the same problem.

Hi Terry Roth 

This issue was resolved by finding ModSecurity rule id(980130, 949110, and 920470) from the logs and adding them to the skip filter rules. 

Thanks,

So when you do that you get this:

The list of skipped filter rules contains the following required infrastructure rules:

• 949110
• 980130

Disabling a required infrastructure rule can lead to attacks not being blocked by web server protection.

Is that really the answer, to skip checks that might lead to a attack?

OK. I added those three but it still doesn't work.

Here is the list I now have:

• 920300
• 920320
• 920420
• 920470
• 949110
• 950100
• 954120
• 954130
• 959100
• 980120
• 980130
• 980140

The problem started after I updated the firewall but I have not really combed through the updated rules and Nat selections. Could this be where things are falling apart?

Also, once this is figured out, it would be nice if Sophos could release an article on how to make this work for others.

Hi Terry Roth 

I would advise you to open a support case for further investigation and PM me the case number so I can help follow up.

Thanks,

 - Can you please confirm that the answer is to bypass a infrastructure rule (980130) as you listed above? 

Hi AllanD,

Could you please confirm if had this issue with Exchange 2016? 

Thanks,

Hi AllanD,

Could you please confirm if had this issue with Exchange 2016? 

Thanks,

2013 here.

Hello good afternoon
Sorry for the late reply, but it was not timely for me earlier.

These are the filters that I have active on my XG, I have exchenge 2010 I don't know if it will make a difference between versions but with me it's working.

920300 active
920320 active
920420 active
949100 active
949110 active
949190 active
950100 active
954120 active
954130 active
960009 active
960010 active
960015 active
960018 active
960915 active
970004 active
970901 active
970904 active
981200 active
981203 active
981204 active
981205 active

best regards