Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 18 replies
  • Answers 1 answer
  • Subscribers 29 subscribers
  • Views 1732 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Blocked ISP's app from the firewall

HUSQA

Hello Gents,

Good Day!

I am new to the Sophos firewall, just upgraded last month to XG210. everything working fine except the billing app from our ISP called "Billexpress Client". I have provided below a download link to test it. when testing, if you get the login page that means it's working.

http://www.ooredoo.qa/portal/OoredooQatar/billxpress

I have allowed ISP's URL: ocbc.ooredoo.qa and ooredoo.com with this format  ^([A-Za-z0-9.-]*\.)?ocbc\.ooredoo\.qa\.?/ & ^([A-Za-z0-9.-]*\.)?ooredoo\.qa\.?/ in new exception list and also allowed them from URL Group. still, it reverts back with an error message before the login page. I have tested without a firewall network and it works fine, the login window simply comes up. it is blocking from the firewall but could not find where it is blocking from. could someone please help me to find the fix for it.

Thanks

Bibash Saud



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to HUSQA

    Hello Husqa,

    Thank you for the screenshot. 

    It looks like you’re using the DPI engine, try creating an exception for the software under Protect >> Rules and Policies >> SSL/TLS using the Destination Network as FQDN.

    Also if you’re on the Control Center, and click under SSL/TLS connections (on the middle right side of the screen), in the new "window" you’ll see a "Fix Errors" click there, and you’ll see a list of domains with issues, search for the domain you are having issues with and then you can click Exclude from Encryption and it would give you the option to Add domain/ Add Subdomain, I think the subdomain will be enough for you.

    Regards,

  • 0 in reply to emmosophos

    Hi Emmanuel,

    Good Day!

    Thanks for your support.

    SSL/TSL is currently switched off. Since I am totally new to Sophos, need your support please. kindly help me to fill the required fields below for the new exception.

  • 0 in reply to HUSQA

    Hello there,

    Can you click on SSL/TLS inspection settings >> Advanced Settings >> SSL/TLS Engine = Disabled

    Then try again.

    As per the exception, it should look something like this, except just change the IP to your PC or testing PC, then for Destination Networks, click Add New Item >> Create New >> FQDN Host

    Name = ooredo

    FQDN = ocbc.ooredoo.qa

    FQDN Host Group = ooredo_FQDN_HG (just because you might need to add more here, it is better to have a Group)

    Regards,

  • 0 in reply to emmosophos

    Hi Emmanuel,

    Sorry for the delay in reply. I have tried that but did not work. is there any way we can find out which another URL or IP Address is trying reaching by this app?

  • 0 in reply to HUSQA

    Hello there,

    I would recommend you to change to Web Proxy, so select in the Firewall rule "Use Web Proxy Instead of DPI engine" and "Decrypt HTTPs During web proxy Filtering"

    Then SSH into the XG and press 5 > 3 to be in the Advanced Shell, then run the following command:

    # service awarrenhttp:debug -ds nosync

    # tail -f /log/awarrenhttp_access.log

    Then access the website, and the log should start populating, with the websites

    Regards,

  • 0 in reply to emmosophos

    Thank you for your reply. this workaround is too advanced for me. this is the production environment so I am really affraid.

    if you can possibly access using TeamViewer or any desk, I can arrange that.

  • 0 in reply to HUSQA

    Hello Husqa,

    For remote sessions, you need to call our Support Team.

    You can simply create a Test Firewall Rule for one PC, use the Computer's IP in the Firewall Rule and put this Firewall on TOP and this will only affect this PC traffic.

    I did the same test on my end and got the following URLs, so you might need to add this ones too:

    https://api.livechatinc.com/

    https://ooredooqa.dimelochat.com

    https://analytics.tiktok.com

    https://accounts.livechatinc.com

    Regards,

  • 0 in reply to emmosophos

    Hi Emmanuel,

    I have added those 4 URLs to the new reception list and the URL group but still the same. i will create a support case for that issue.