Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 17 replies
  • Answers 1 answer
  • Subscribers 32 subscribers
  • Views 2211 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall rules not working as expected

SGICT

Hi,

I've rolled out many UTMs in the past and now starting to replace them with XGS, v19.

Pretty much makes sense but im puzzled by the firewall rules and how they are executed.

Here's one example that I dont get

I have simple LAN - 192.168.1.X that has Netgear wifi broadcasters attached to them.

I needed to create a guest network on those wifi broadcasters so created that with a VLAN, ID20, IP 192.168.100.x. Zone is LAN

Setup on the XGS the stuff required so Vlan interface, DHCP for vlan, etc etc.

The firewall rule is

All working fine, users are on guest, got internet, no problem. I can see clearly from the DHCP pool table that the guests are getting IP addresses for that Vlan segment.

However, as you see from the rule 0 B and 0 B for in and out.

I now wonder if the phones are just falling over to 4g because I look at the firewall logs and all I see is denies for anything from that network going out to the internet, not a single Allow.

Im really stumped because I dont know why its saying invalid packet or how to progress with this

Throwing a random idea but on UTM you had to create a masq rule for all networks needing the internet, I havent done that nor clicked on create NAT rule during the firewall rule setup. Should I have done or does the XGS handle that?

Many thanks in advance if you can help



Edited TAGs
[edited by: Erick Jan at 4:42 AM (GMT -8) on 15 Nov 2022]
  • 0 in reply to LHerzog

    Its connected direct to a WAN router (which is in pass through mode), no upstream firewall or router doing any routing, just the XGS handling everything

  • 0 in reply to LuCar Toni

    Just wonder how QUIC would affect this and cause 0B traffic both way?

    The 2nd one, I can save fine.

  • 0 in reply to SGICT

    Just wondering: Your Object are actually matching? 

    Can you share screenshots of the used Source Objects? 

    __________________________________________________________________________________________________________________

  • 0 in reply to SGICT

    there is UDP 443 traffic in that screenshot but also TCP 443. so it is not only a QUIC issue.

    what does your firewall do when it tracerts to WAN IPs?

    does it work?

    is the XGS picking up pattern updates?

    Maybe other modules block your traffic? Known for this behaviour would be Application filter. Just toggle to the advanced view.

  • 0
    How to Cleanup Your Firewall Rule Base
    1. Structural Redundancy Analysis.
    2. Log Usage Analysis.
    3. Remove technical errors in the rules.
    4. Remove unused accesses.
    5. Review rules and refine access.
    6. Monitor the policy constantly.

    Hope You Find This Useful,
    Peter

  • 0 in reply to LHerzog

    I think im simply going mad here. Your suggestion of switching to advanced view, I could see the traffic from Vlan 20 being allowed, in simple view all I saw was denies - Way to go Sophos with that one.

    Anyway, that at least explained how traffic on vlan20 was getting out to the internet at least.

    However, it didnt explain in the firewall page why the rule showed 0B in and out, so to be honest I had enough of it and logged off.

    Its been about 7 days and I've just gone back onto the firewall to have a fresh take on it and now its showing traffic, i.e. that rule, which I havent touched, shows 55Gb and 4.4gb. No one else has access to the firewall, the rule hasnt been changed, not moved or anything.

    So my solution is, crack a beer open and watch Netflix because I cant blo*dy explain that.

  • 0 in reply to SGICT

    Looking into the Packet Capture for Port443. Does your firewall rule match? 

    Because somehow i have the feeling, your client is not using the firewall at all. 

    __________________________________________________________________________________________________________________

Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?

Unfiltered HTML