Sophos XGS 126 : access seems impossible

Hi Roberto Catanuto

Do you have a serial cable that comes along with Sophos XG box?

If you have that cable with you follow the link: https://support.sophos.com/support/s/article/KB-000035769?language=en_US if you get console access with 7 options available or raise RMA as per the link.

Please try to get GUI access as per the below link : 

https://support.sophos.com/support/s/article/KB-000038694?language=en_US

Thanks and Regards

If you're trying to go to the admin console, you should use: 

https://<LAN IP Address of the device>:4444

Also try to ping the IP of the XGS126 device to make sure it's reachable from your Mac. 

The reference guide you're using is for v17, which is quite old. 

Here's the latest for reference 

docs.sophos.com/.../index.html

Trying the ping I received:

$ ping <IP_Firewall>

PING <IP_Firewall> (<IP_Firewall>): 56 data bytes

Request timeout for icmp_seq 0

Request timeout for icmp_seq 1

Request timeout for icmp_seq 2

Request timeout for icmp_seq 3

ping: sendto: No route to host

Request timeout for icmp_seq 4

ping: sendto: Host is down

Request timeout for icmp_seq 5

...

---<IP_Firewall> ping statistics ---

7 packets transmitted, 0 packets received, 100.0% packet loss

And in Chrome I received: 

ERR_CONNECTION_TIMED_OUT

Hi  Roberto Catanuto

Do you have access to the console as per the link   Sophos Firewall: How to setup a Serial connection with a console cable  now ?

If yes go to option 4 on CLI access and run tcpdump and share the output 

console>tcpdump 'host <Sophos XG IP> and proto ICMP (tcpdump 'host 192.168.1.1 and proto ICMP)

console>dr 'host <Sophos XG IP> and proto ICMP

Regards

The access to the console has been granted.

Now after the first command I got:

console> tcpdump 'host <Sophos XG IP> and proto ICMP

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes

---

And then after 5 minutes nothing happens, is that correct?

Please share a screenshot of tcpdump traffic from console access.

Verify if the appliance access is disabled by running the following command from the console: 

system appliance_access show

(show share the output)

system appliance_access disable

Then Go to Administration > Device access to enable HTTPS on the required zone and share the screenshot 

Share the output by option 5 then with option 3 

psql -U nobody -d corporate -c "select destinationport from tbllocalservicedetails WHERE localserviceid =2" 

service -S | grep  -iE 'tomcat|apache'

Regards

From your first command, I got

console> system appliance_access show

Appliance access disabled.

---

Also, where is "Administration > Device access" ?