This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unable to make HTTP/S traffic forwarding to internal webserver work with XG SFOS 18.0.3 MR-3 ( Azure Deployment)

Hi Everyone,

Currently we have a working solution when using SophosXG 17 , but currently it seems that port forwarding isnt working like we expected on XG 18, While it was massively simply before, we are unable to make it work on our Azure environment.

From our side, we followed the simple steps when clicking on Add firewall rule > Server access Assistant (DNAT) where:

Internal server IP address: our proxy server private IP

Public IP address: SOphosXG public IP ( using a port Alias defined with the external IP )

Services: HTTPS

External source networks and devices: Any

Its important to notice I have followed the documentation provided by the support/ youtube videos/ vimeo videos but still, not success at all.

So, the question would be, does anyone had success with port forwarding with XG18 deployed on Azure? We have been delaying the migration of our 17 to 18 just because of this blocker.

This thread was automatically locked due to age.

Top Replies

LuCar Toni over 4 years ago +1

Did you allow HTTPS on the NSG in Azure? If you do not see the packets on the XG, it is a indicator, Azure is not allowing those packet to arrive on Xg.

Parents

0 LuCar Toni over 4 years ago

Did you allow HTTPS on the NSG in Azure? If you do not see the packets on the XG, it is a indicator, Azure is not allowing those packet to arrive on Xg.
Cancel
Vote Up +1 Vote Down

Cancel

Reply

0 LuCar Toni over 4 years ago

Did you allow HTTPS on the NSG in Azure? If you do not see the packets on the XG, it is a indicator, Azure is not allowing those packet to arrive on Xg.
Cancel
Vote Up +1 Vote Down

Cancel

Children

0 Thales over 4 years ago in reply to LuCar Toni

Hi, yes, nsgs rules are fine too. For debugging purposes i even added new inbound rule to allow a wider port ranges to allow traffic from my IP addr ess, so i could text with other ports besides https.

At this moment, NSG rules are the same that we have in place for our XG17.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to Thales

You should connect yourself via SSH and perform a tcpdump.

Verify, if those packets actually arrive and if the XG tries to forward them.
Cancel
Vote Up 0 Vote Down

Cancel
0 Thales over 4 years ago in reply to LuCar Toni

Ok, I have some progress, I was able to make it work using the XG WAN private IP, but not with the XG Public IP ( served by the load balancer)

I noticed that the runbook sophosxg-automation/XG-LB-routing was not excuted after the deployment. which, even executed manually, i still cant make the traffic flow as rquired.

Relevant information: community.sophos.com/.../sophos-xg-firewall-how-to-implement-a-full-ha-inbound-outbound-on-azure
Cancel
Vote Up 0 Vote Down

Cancel