[SOPHOS AP55C ] Unable to migrate Sophos AP55C from Sophos XG105 to Sophos Central Wireless

Hello there,

Thank you for contacting the Sophos Community

Make sure you are disabling the Wireless module from the XG

(System >> Administration >> Device Access. And Disable all of the Wireless Protection for all of the Zones)

Regards,

Hello,

Thank you for your help !

I have disable Wireless Protection for all zones but it still doesn't work.

I thought it could have been the router but there is no router between the firewall and the provider. It is the firewall that acts as the router.

Regards,

Raphaelle B

Hello there,

Thank you for the screenshot.

Have you also disabled Wireless Protection from Wireless >> Wireless Settings >> Global Settings?

If the issue remains, if you do a tcpdump do you see the packets leaving the XG?

Regards,

is there a DHCP server, serving IP addresses for the AP?

Is it on XG?

If this is on XG, you can see, if it received an IP address.

If it did not receive IP address, check this KB and enable DHCP global scope 

Next, check the IP address it received in Firewall, TLS and Webfilter logs. Probably there is a port or URL to Sophos central beeing blocked or beeing intercepted by HTTPS decryption.

Make sure all ports are open and all requested URL by the AP are excluded from TLS and HTTPS scanning.

Check this thread for ports and URL required from documentation AND a port beeing undocumented and needed, at least for APX, maybe also for 55C.

Also, there is a need for the APs to allow NTP to ANY address.

Hello,

I have disabled Wireless protection on Global Settings + Device access

But it still dosn't work :/

Regards,

Raphaelle B

Hello,

Thanks for your reply.

It's on XG yes. He is the DHCP server and my AP received an IP : 

The AP works fine when i add it on XG.

I have read your post and add an firewall rule that allow all services for the AP : 

But it still doesn't work too :/ 

Regards,

Raphaelle B

Hi,

you don't need a NAT.

Ian

Please confirm, the logs I mentioned do not show any blocks for the Source IP.

Hello,

Thanks for your reply.

I have unchecked the NAT Masquering on the firewall rule like you said.

I have re tried the attribution but it's already weird.

I have check the Policy tests : 

prod.hydra.sophos.com and apu.sophos.com doesn't work but i throught it's normal.

Weird things: 

The AP communicate only with DNS i don't know if its weird too ? I think, it's only because it wait to be assigned.

Regards,

Raphaelle B

Hello,

Thanks for your reply.

I have unchecked the NAT Masquering on the firewall rule like you said.

I have re tried the attribution but it's already weird.

I have check the Policy tests : 

prod.hydra.sophos.com and apu.sophos.com doesn't work but i throught it's normal.

Weird things: 

The AP communicate only with DNS i don't know if its weird too ? I think, it's only because it wait to be assigned.

Regards,

Raphaelle B

in the new test-firewall rule AP to WAN ANY Service, please enable logging and put it on top of your ruleset.

Also as mentioned, check TLS and Webfilter Log.

Hello,

The rule is already on the top of ruleset.

Sorry but i have checked HTTPS scan and Web policy (Allow all) on firewall rule + check log firewall traffic : 

But i don't know how to show TLS and Webfilter log. I looked at logs viewers but there is no logs after a retry of adding the AP to Sophos Cloud : 

Regards,

Raphaelle B

You can switch to the Advanced View in Logviewer (on the mid the blue icon) and check for the entire logs. Then check for your IP. 

Hello,

Here, you can find the advanced logs : 

messageid="00001" log_type="Firewall" log_component="Firewall Rule" log_subtype="Allowed" status="Allow" con_duration="30" fw_rule_id="5" policy_type="1" user="" user_group="" web_policy_id="1" ips_policy_id="0" appfilter_policy_id="0" app_name="DNS" app_risk="1" app_technology="Network Protocol" app_category="Infrastructure" in_interface="Port1" out_interface="Port4_ppp" src_mac="00:00:00:00:00:00" src_ip="192.168.1.11" src_country="R1" dst_ip="8.8.8.8" dst_country="USA" protocol="UDP" src_port="51131" dst_port="53" packets_sent="1" packets_received="0" bytes_sent="67" bytes_received="0" src_trans_ip="" src_trans_port="0" dst_trans_ip="" dst_trans_port="0" src_zone_type="LAN" src_zone="LAN" dst_zone_type="WAN" dst_zone="WAN" con_direction="" con_event="Stop" con_id="2196261912" virt_con_id="" hb_status="No Heartbeat" message="" appresolvedby="Signature" app_is_cloud="0"
messageid="00001" log_type="Firewall" log_component="Firewall Rule" log_subtype="Allowed" status="Allow" con_duration="30" fw_rule_id="5" policy_type="1" user="" user_group="" web_policy_id="1" ips_policy_id="0" appfilter_policy_id="0" app_name="DNS" app_risk="1" app_technology="Network Protocol" app_category="Infrastructure" in_interface="Port1" out_interface="Port4_ppp" src_mac="00:00:00:00:00:00" src_ip="192.168.1.11" src_country="R1" dst_ip="8.8.8.8" dst_country="USA" protocol="UDP" src_port="54806" dst_port="53" packets_sent="1" packets_received="0" bytes_sent="68" bytes_received="0" src_trans_ip="" src_trans_port="0" dst_trans_ip="" dst_trans_port="0" src_zone_type="LAN" src_zone="LAN" dst_zone_type="WAN" dst_zone="WAN" con_direction="" con_event="Stop" con_id="3649773912" virt_con_id="" hb_status="No Heartbeat" message="" appresolvedby="Signature" app_is_cloud="0"
messageid="00001" log_type="Firewall" log_component="Firewall Rule" log_subtype="Allowed" status="Allow" con_duration="30" fw_rule_id="5" policy_type="1" user="" user_group="" web_policy_id="1" ips_policy_id="0" appfilter_policy_id="0" app_name="DNS" app_risk="1" app_technology="Network Protocol" app_category="Infrastructure" in_interface="Port1" out_interface="Port4_ppp" src_mac="00:00:00:00:00:00" src_ip="192.168.1.11" src_country="R1" dst_ip="8.8.8.8" dst_country="USA" protocol="UDP" src_port="48452" dst_port="53" packets_sent="1" packets_received="0" bytes_sent="67" bytes_received="0" src_trans_ip="" src_trans_port="0" dst_trans_ip="" dst_trans_port="0" src_zone_type="LAN" src_zone="LAN" dst_zone_type="WAN" dst_zone="WAN" con_direction="" con_event="Stop" con_id="3649778384" virt_con_id="" hb_status="No Heartbeat" message="" appresolvedby="Signature" app_is_cloud="0"
messageid="00001" log_type="Firewall" log_component="Firewall Rule" log_subtype="Allowed" status="Allow" con_duration="30" fw_rule_id="5" policy_type="1" user="" user_group="" web_policy_id="1" ips_policy_id="0" appfilter_policy_id="0" app_name="DNS" app_risk="1" app_technology="Network Protocol" app_category="Infrastructure" in_interface="Port1" out_interface="Port4_ppp" src_mac="00:00:00:00:00:00" src_ip="192.168.1.11" src_country="R1" dst_ip="8.8.4.4" dst_country="USA" protocol="UDP" src_port="38374" dst_port="53" packets_sent="1" packets_received="0" bytes_sent="68" bytes_received="0" src_trans_ip="" src_trans_port="0" dst_trans_ip="" dst_trans_port="0" src_zone_type="LAN" src_zone="LAN" dst_zone_type="WAN" dst_zone="WAN" con_direction="" con_event="Stop" con_id="3649777696" virt_con_id="" hb_status="No Heartbeat" message="" appresolvedby="Signature" app_is_cloud="0"
messageid="60020" log_type="Event" log_component="DHCP Server" log_subtype="System" status="Renew" leased_ip="192.168.1.11" src_mac="00:1a:8c:b6:98:8e" client_host_name="" message="Lease IP 192.168.1.11 renewed for MAC 00:1a:8c:b6:98:8e" raw_data="192.168.1.11 Mon 28 Mar 11:35:54 2022 Tue 29 Mar 11:35:54 2022 00:1a:8c:b6:98:8e AP55C-XXXX"

Regards,

Raphaelle