This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Nesting of allowed Web Applications possible?

Hi,

is it possible to nest web application rules?

Take this little Chart:

I would like to allow different applications to different users on the XG Firewall based on their user heartbeat.

So the idea is to create several rules for each application and put the apps inside each rule. Then put all the users that need it into this rule.

Currently my problem is, that the first matching rule wins:
e.g. if I Allow Office 356 to User A - he is only allowed to use Office 365 - nothing else.

This makes it very uncomfortable to keep track with changing user requirements, because I need almost one Web / Application Rule for each user.

This thread was automatically locked due to age.

Top Replies

Prism over 4 years ago in reply to LHerzog +3

I hope I'm wrong, but by the last conversations I had with support "Nesting" rules are not possible because the management plane on Sophos XG is horrible. Let's say you have two rules for User A. 1…

0 LHerzog over 4 years ago

Please, any ideas on this?
Cancel
Vote Up 0 Vote Down

Cancel
0 Prism over 4 years ago in reply to LHerzog

I hope I'm wrong, but by the last conversations I had with support "Nesting" rules are not possible because the management plane on Sophos XG is horrible.

Let's say you have two rules for User A.

1) Allow Facebook, Deny everything else.

2) Allow O365, Deny everything else.

By default XG will match everything on Rule 1, even if O365 is allowed on Rule 2 It will still be denied since by default the Rule 1 have a "Deny" all.

The only way to do this is by having a single rule by user, that applies everything (All Apps/Web policies) for that user.
Cancel
Vote Up +3 Vote Down

Cancel
0 LuCar Toni over 4 years ago

As those apps have the same service port, this is not possible, for now.

There was a bigger discussion about this: https://community.sophos.com/xg-firewall/f/discussions/123000/application-control-and-port-dependencies/448208#448208
Cancel
Vote Up +2 Vote Down

Cancel
0 LHerzog over 4 years ago in reply to LuCar Toni

Thanks LuCar Toni, was a good reading through this discussion you mentioned.

Thanks Prism, you seem to have lots of experience and knowledge in this and what XG is capable of or not.
Cancel
Vote Up 0 Vote Down

Cancel