Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 1293 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG PCI Scan Failing - UDP500

Dave Hayes

Hello All. I hope everyone is having a good weekend.

So we are replacing about 62 older Sophos UTM 9.0's with Sophos XG's. All of these sites are have been connected for years with a hub and spoke VPN via site to site IPSec VPN tunnels and we have never had an issue passing PCI scans. However we have deployed 12 of the 62 XG's and each one of those fails with UDP port 500 open. We have looked at the solutions provided such as disabling strongswan or sending UDP500 to a blackhole (preferred). These get the XG's to pass the scan but UDP500 is needed for IPSec site to site tunnels and they fail. These devices have nothing enabled on the WAN ports under Device Access that would cause this.

Other than disputing it with the PCI Scan Vendor (Trustwave) how have you handled this situation.?

What is odd to me is that all the existing UTM's are working fine (They can initiate as well as respond to IPSec).  When I do a nmap scan against the IP address on UDP port 500 it shows as Open/Filtered on the UTM's but Open on the XG's which is likely why it is failing.

Others have suggested limited UDP500 via peer IP's and I can easily do that since all sites are static.  However, I do not think it is possible to limit this via a firewall rule.

Thanks everyone for any ideas.

Dave



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for reaching out to Sophos Community.

    We tried to replicate the reported behavior in our lab environment.

    With a Blackhole configuration, we were unable to establish the IPsec tunnel.

    To allow IPsec communication we've created a new NAT rule(ID: 10) as below on top of the blackhole NAT rule(ID: 8). No firewall rule is required to allow/deny UDP 500 traffic.

    Note: Tunnel is configured with WAN interface Port2 as a listening interface.

    New NAT rule(to allow udp port 500 communication from specific IPs)

    Blackhole NAT ID: 8

    =============================================

    Translation settings:

    Original source: Static IPs of all branch locations
    Original destination: IPsec listening interface
    Original service: UDP port 500
    Translated source (SNAT): Original
    Translated destination (DNAT): IPsec listening interface IP address
    Translated service (PAT): Original

    Interface matching criteria:

    Inbound interface: IPsec listening interface
    Outbound interface: IPsec listening interface

    =============================================

    If the tunnel doesn't get establish after configuring a new NAT rule, please flush the connection for branch static IP from the console.

    Login to SSH > 4. Device Console

    console> system diagnostics utilities connections v4 delete src_ip <Branch static IP>

    Example:

    console> system diagnostics utilities connections v4 delete src_ip 5.5.5.5

     

    We request you to share an observation of the PCI scan with this configuration.

Reply
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for reaching out to Sophos Community.

    We tried to replicate the reported behavior in our lab environment.

    With a Blackhole configuration, we were unable to establish the IPsec tunnel.

    To allow IPsec communication we've created a new NAT rule(ID: 10) as below on top of the blackhole NAT rule(ID: 8). No firewall rule is required to allow/deny UDP 500 traffic.

    Note: Tunnel is configured with WAN interface Port2 as a listening interface.

    New NAT rule(to allow udp port 500 communication from specific IPs)

    Blackhole NAT ID: 8

    =============================================

    Translation settings:

    Original source: Static IPs of all branch locations
    Original destination: IPsec listening interface
    Original service: UDP port 500
    Translated source (SNAT): Original
    Translated destination (DNAT): IPsec listening interface IP address
    Translated service (PAT): Original

    Interface matching criteria:

    Inbound interface: IPsec listening interface
    Outbound interface: IPsec listening interface

    =============================================

    If the tunnel doesn't get establish after configuring a new NAT rule, please flush the connection for branch static IP from the console.

    Login to SSH > 4. Device Console

    console> system diagnostics utilities connections v4 delete src_ip <Branch static IP>

    Example:

    console> system diagnostics utilities connections v4 delete src_ip 5.5.5.5

     

    We request you to share an observation of the PCI scan with this configuration.

Children
No Data