Allow Starcraft II to run on XG SFVH (SFOS 18.0.4 MR-4)

What services have you allowed in your rule?
ian

I've allowed ANY

Have you looked through each of the logs? (I assume they are the same as on an XGS appliance.) For example, I was totally puzzled about something that wasn't working and there was nothing in the (Firewall) log... I eventually found the issue in the TLS log and it was not because it was attempting to decrypt but because it was rejecting weak encryption.

Hi Wayne Folta, unfortunately, not well versed at reading logs.  I know the IP address of the desktop, I saw many invalid traffic that was denied under that IP.  I also saw some of them was from Blizzard's IP, Starcraft.  I believe not only 1 IP is from Blizzard, it should have multiple.  I don't know what I can do with that information.   

Well, the firewall still inspect all traffic even if you don't have any option enabled on the firewall. Mostly because of ATP and other IPS check. To disable those, you need to go to the advanced configuration and create an exemption for that rule.

https://support.sophos.com/support/s/article/KB-000038900?language=en_US

Thanks.  I didn't know this.  I will definitely read up on this.  I'd still like to find out how to fix the issue. 

In the KB shows how. Just run a command with the rule ID and thats it

Ok then, I'll read up and reply again.

Edit:  I read this, and followed instructions.  Bypassed fwrule 1 and 2.  Still, the app won't run.  Don't really understand what the command is supposed to achieve.  I imagine after bypassing the fwrule, app should run?

Hello there,

Adding to what has been mentioned and suggested, if you really need to use Web Filter, most likely you would need to create some Web exceptions, you can run the following command from the Advanced Shell of the XG 

# service awarrenhttp:debug -ds nosync

# less awarrenhttp_access.log | grep x.x.x.x (x.x.x.x IP of your computer)

It should show you if something is being blocked. Also try creating a Firewall rule without any Web Filtering at all see if this works, you might need also to create a SSL/TLS exception rule if your are using DPI instead of Web Proxy.

Regards,

Hi.  It turns out whether it's the setting above with everything allowed, makes no difference from having Web Filter set to No ads or Explicit content, Scan Https, Scan FTP, (both enabled),  Block very high risk (App control) and lantowan_general (IPS). 

Either way, if I started the app, and leave it long enough, it will run eventually, maybe 3 to 5 minutes or so.  On the otherhand, once I connected it to portable hotspot bypassing the firewall, it starts almost immediately.  

How do I begin troubleshooting this? 

How do I "create a SSL/TLS exception rule if your are using DPI instead of Web Proxy."