This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Subnet to WAN traffic with incomprehensible behavior

Hello everyone,

i'm stuck with a problem on our XG with a real "weird" behavior and i'm close to believe that the XG is malfunctioning.

I've created a new subnet in our network to separate telefon traffic. So basically the new subnet needs to be able to do two things:

1. route to the client network (for softphone functionality) -> works fine

2. subnet to WAN and back to the telefone provider (static IP port 5060 SIP traffic) for testing it can reach any IP and additional ICMP for testing.

I've tested the behavior on a windows and a linux machine in the subnet with the same problem so i would exclude a os configuration problem.

Problem:

When i use the console to ping something (8.8.8.8 f.e.) it will timeout no response

When i Open the Browser on the same Server to https://8.8.8.8 it works fine

when i watch the livelog on the Firewall i can see the "working" packets pass. The ping packets won't even show up in the XG

Does anyone got a similar problem? If possible i want to avoid a restart because it would have impact on productivity

Kind regards

This thread was automatically locked due to age.

0 rfcat_vk over 4 years ago

How is the sub-net identified on the XG?

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Mirco Odau over 4 years ago in reply to rfcat_vk

Hey,

i don't rely know what you mean with identified.

The sub-net is configured as as following:

Network/Interfaces/Vlan:

The configuration is the same like the working Networks.20 which is also in the Zone LAN

configuration of the Zone:

Nat:

maybe that helps
Cancel
Vote Up 0 Vote Down

Cancel
0 Mirco Odau over 4 years ago

Edit: Additional information:

Tracert on windows to destination ip times out after the default Gateway hop (192.168.5.1) but internet connection is still available and working.

Also Checking ping on the XG policy tester is green while the reality is like written above
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Mirco Odau

Hi Mirco Odau,

Thank you for reaching out to Sophos Community.

What's the current running firmware version?

Try disabling firewall-acceleration and share your observation.

Login to SSH > 4. Device Console

console> system firewall-acceleration disable
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Mirco Odau
Hi Mirco Odau,

Did you register your firewall? Do you have a valid base license on your firewall?

I'd suggest you run a packet capture on your firewall from Diagnostics > Packet capture to check the correct firewall rule id applied to the outbound traffic.

Monitor traffic using Packet Capture Utility in the Sophos XG Firewall GUI

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 Mirco Odau over 4 years ago in reply to FormerMember

Hi,

i checked the Packet Capture and now i'm starting to believe im stupid idk.

There are no captured packets for the host in the problematic sub-net. I've set the settings like mentioned in your link and tested with a host from another sub-net to check if the packet capture is working (it is)

If i ping 8.8.8.8 from the other subnet i can see the captured packages

If i ping 8.8.8.8 from the problematic subnet i get a timeout and NO packets at all. Even if i surf the web with the testhost (which works) i still get no packages at all in the packet capture
Cancel
Vote Up 0 Vote Down

Cancel
0 Mirco Odau over 4 years ago in reply to FormerMember

Hi,

it's running on XG210 (SFOS 18.0.5 MR-5-Build586)

console> system firewall-acceleration disable -> did not solve the problem
Cancel
Vote Up 0 Vote Down

Cancel
0 Mirco Odau over 4 years ago

Additinal information:

Ping from the "not working" sub-net is shown in the log Viewer (outgoing)
Cancel
Vote Up 0 Vote Down

Cancel