XG3300 Firewall MTU/MSS

Do you use STAS? Do you have STAS Quarantine enabled? 

No I do not use STAS - I do use Intercept X Advanced with XDR and MTR on all of my endpoints though which may possibly have some components of it since it has a heartbeat sync with the firewall.  Although I think it does all that through Central if I'm not mistaken.

Hi Nick Goad

Please troubleshoot the issue with Plain/bypass firewall rule for that two users add system IP under Source networks and devices on firewall rule and check it working with the same rule or not ?

From SSH Go to option 4 and check drop as per the link command available 

https://support.sophos.com/support/s/article/KB-000036858?language=en_US 

Share the suspicious logs and status working with plain rule ?

Thanks and Regards

Could you do the following (step by step) and check, if any of those steps resolves your Issue? 

https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/134998/troubleshoot-a-broken-application-in-sfos

Please do not do "everything at once" instead, try each step and see, if it still occur. 

I am looking in the firewall logs now that I have captured quite a bit of information from Wireshark packets and what I am seeing is lots of traffic that is coming BACK IN from the WAN (internet) zone to the LAN zone and still some that is leaving the packets are being denied but the only reason the log gives is either "Invalid Packet" or "could not associate packet to any connection".

All these log entries have a Log Comp of "Invalid Traffic",  Nat rule of 0 and a rule type of 0 so that doesn't really tell me much.

I do have 2 WAN links (2 providers) for redundancy and they are just set up to load balance but I configured an SD-WAN rule to only make traffic for this side go out of one of them which from the interfaces in the logs it looks like it is using the correct internet connection.

What doesn't make sense is that there will be a ton of packets that go out fine then all the sudden there will be a bunch of invalid ones.

Can I do this during production hours without resetting connections/interfaces or should I do it during off hours?

You should do this tests with a downtime window, just in case. Normally this will not affect active connections.  

Ok but just FYI when I put the log in detailed view none of the error packets are using the SSL/TLS inspection engine only the firewall.  And many of them are marked as "Could not associate packet to any connection."

And I've actually already gone into Protection -> Advanced Threat Protection and added the FQDNs of the sites to the Network/Host Exceptions list and that did not help fix the issue.

The ATP Bypass via CLI is something else. It works on a different level on the CLI please try it there. 

Ok I have excepted the ATP from the firewall rule that allows the traffic from the LAN -> WAN to the specific FQDNs of this web service.  I will check with the users and see if this makes any difference.

Ok I have excepted the ATP from the firewall rule that allows the traffic from the LAN -> WAN to the specific FQDNs of this web service.  I will check with the users and see if this makes any difference.