Sophos Firewall

Discussions Sophos XG identifies Wireguard VPN as NTP.

Sophos Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 2 replies
Subscribers 27 subscribers
Views 1674 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG identifies Wireguard VPN as NTP.

Prism over 4 years ago

Hi,

Seriously, how is this even possible ?

How to replicate this:

Run a Wireguard VPN (Server) over UDP/123.

Can we please get a signature update for It ?

Thanks!

This thread was automatically locked due to age.

0 rfcat_vk over 4 years ago

Ii would suspect that the XG does not investigate the packets correctly. 90% of my NTP is classified as UDP 123 not reported as NTP. Also there are other intermittent mis-analyis because Apple access is occasionally called a VPN tunnel along with intermittent mail access being reported as an attack on a MS mail server (external).

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 4 years ago in reply to rfcat_vk

A correction, the XG classifies some Apple connections occasionally as ultra surf proxy.

Ian
Cancel
Vote Up 0 Vote Down

Cancel