Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 21 replies
  • Answers 2 answers
  • Subscribers 28 subscribers
  • Views 2618 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to log Drops from advanced-firewall checks

AndreasHämmerle

Hello,

We have a clients-server based application, where the server is in a different vlan as the clients.

The communication between both vlans is routed via SophosXG VLAN Interfaces. (XG430 / 18.5MR1)

The GUI firewall rules are configured to allow everything for both vlan-networks in each direction.

However, this client-server based application doesn't work with this setup.

Only way to get the application working as expected is to set advanced-firewall bypass via CLI

I assume that the application is not working 100% RFC conform and for example the XG tcp-seq-checking drops the packege.

My problem is, I cant see any dropped packeg in any log on XG firewall.

I need to know exactly why the firewall is dropping that traffic in order to contact the application vendors if something is not RFC compliant at application side.

Can you please tell me how to log such kind of drops from the advanced-firewall checks.

Thank you for help!



This thread was automatically locked due to age.
  • 0 in reply to LuCar Toni

    Ok, to follow your theory, do you have any hints where I could search first if this proxy interception took place on XG?

    The firewall rules for internal traffic doesn't have any Webfilter enabled.

    Only firewall rules for internet traffic uses DPI with TLS Decryption, so it should not be relevant for my Problem.

    This 401 unauthorized is a good question, I have seen this in both Traces:

    when the atp_ac rule is disabled -> there is the RST right after the unauthorized

    when the atp_ac rule is enabled -> there is also the same unauthorized message (Access is denied due to invalid Credentials) but the application is working as expected. I can see the next packages in Wireshark Trace are HTTP/XML SOAP packages instead of the RST.

    If it is helpfull, I could send you both Wireshark captures via PN that you can see the difference.