Empty Source Port Log - Sophos XG

Hi Unks,

The first denied log without interface could be traffic destinated to the Firewall.

Do you want to block/allow a particular TCP/UDP Port from LAN to WAN? 

Hello Adctech, I do want to allow the 443 port from LAN to WAN, I was able to add it but when I test it, I can see some 443 blocks even that I have the port added to the interface.

Thanks!

Hi @Unks,

Could you please share the log viewer log which shows denied traffic? The given denied logs show Invalid traffic but need a full snapshot with a message.

Hello, let me know if this works

thanks!

Hi,

the second entry in that post is a connection that has finished and not closed completely. The error message on the righthand side is important. It is not a valid access.

Ian

Hi Unks,

Thanks for sharing the snapshot.

Denied logs shows "Could not associate packet to any connection". This means conntract of packet was deleted and after that this packet received on the Firewall. 

You may refer below KBA:
support.sophos.com/.../KB-000037984

Are you facing any issues with actual access of port 443 on a destination? 

Hello Adctech, yes I have an openvpn client that fails the SSL TLS to validate the cert. I was trying to allow just specific ports, but due to this case that I was not sure how to find it, I tested, and if I allow all the services it works.

so, do you think that increasing the timeout for the protocol could fix it?

thanks for the help

Unks,

In that case,  increasing the timeout for the protocol may not fix the issue. 

To find ports used by the OpenVPN server, you can take tcpdump on the OpenVPN server from CLI option no.4 using the below command.

tcpdump 'host SERVER_IP   (Replace SERVER_IP using actual OpenVPN server).

After executing the above command, try to connect the OpenVPN client and see the dest port on tcpdump. 

You can use "CTR +C" key to stop tcpdump.

Ok Let me try that, so then the point is that might be other porta used, correct?

Hi Unks,

Yes, I suspect it as you mentioned that it works with all services.

Hi am still checking the ports, will reply once I can trace the packets, thanks for the help Akash Chheliya, thanks for the reply rfcat_vk I am checking what can cause this

Hi am still checking the ports, will reply once I can trace the packets, thanks for the help Akash Chheliya, thanks for the reply rfcat_vk I am checking what can cause this