Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 9 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 2239 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG - HTTP connection reset from firewall?

Pavol Krigler

Hello,

we have noticed one http traffic issue on Sophos XG 210 with release 18.0.4. We have defined a firewall rule which is allowing all services from LAN to (RMX) server. 

Port1 = LAN zone

Port3.3353 = RMX server zone

When we try to connect from PC in LAN zone using "RMX Manager" application the Application sometimes connects to the RMX server and sometimes not.We are not able to reproduce the issue because sometimes from 10 connections are 2 OK, sometimes from 10 connections are 4 OK. It looks like a "random" issue.

But when we move the same PC from LAN zone directly to the RMX server zone (bypassing FW) the connection to the server is stable. So it looks like the problem is on firewall.

The log below show unsuccessful connection from LAN to RMX server:

07:37:17.266471 Port1, IN: IP 192.168.10.115.63870 > 10.100.5.218.80: Flags [P.], seq 763:1196, ack 2589, win 1026, length 433: HTTP: POST http://rmxsrv:80 HTTP/1.1
07:37:17.266682 Port1, OUT: IP 10.100.5.218.80 > 192.168.10.115.63870: Flags [.], ack 1196, win 126, length 0
07:37:17.267150 Port1, IN: IP 192.168.10.115.63870 > 10.100.5.218.80: Flags [P.], seq 1196:2167, ack 2589, win 1026, length 971: HTTP: POST http://rmxsrv:80 HTTP/1.1
07:37:17.267643 Port3.3353, OUT: IP 192.168.10.115.63870 > 10.100.5.218.80: Flags [R.], seq 763, ack 2589, win 0, length 0
07:37:17.267655 Port1, OUT: IP 10.100.5.218.80 > 192.168.10.115.63870: Flags [R.], seq 2589, ack 2167, win 0, length 0

In the Sophos logs there are no "denied" or dropped packets or connections.

The most interesting part of the log is this line below. It looks like the client IP 192.168.10.115 is sending TCP RESET but the RESET is not sending from Port1 - LAN zone. The TCP RESET is sending Sophos XG firewall from Port3.3353 interface to the RMX server.

Port3.3353, OUT: IP 192.168.10.115.63870 > 10.100.5.218.80: Flags [R.]

Thank you,

Pavol



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to Pavol Krigler

    The "bug" or behavior is caused by the Dropping rule. So XG will drop the traffic, as this rule matches. It does drop it with the proxy, not the firewall rule.

    But your issue seems to be caused, as the firewall rule, you are showing, seems to randomly misses the traffic and the default drop hits. 

    What you should do: It could be related to the Match known users. If you looses the connection, do you have any other services looses connection on this particular client? This means, the XG looses the user connection, hence the firewall does not match.

    You could try to remove the ANY or build a new plain firewall rule for this host and check, if this still occurs. 

Children