Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG No Internet

Hi everyone,

I am in a bit of a situation here with my Sophos XG Firewall. Earlier today I had to reboot the server that the Sophos VM is in for an unrelated issue. After everything rebooted, I have not been able to connect to the internet at all on any device in the LAN of the XG. Since I set the firewall up a few weeks ago, I have seen a bunch of Firewall logs that show the source IP of 192.168.1.1 making a bunch of random entries that are blocked. For example, the log is full of "Appliance access denied" from 192.168.1.1 with a destination of 255.255.255.255. My internet infrastructure is as follows, internet (coax) from isp goes to the modem, modem ethernet output goes to Eero gateway, and Eero's other LAN port connects to a small switch going to the host PC and the WAN port of the XG. For simplicity, I have Sophos XG VM's internet ports completely separate from the host operating system and other VMs. The server PC has 1 ethernet port for the host OS and all other VMs, and 2 ethernet ports dedicated to Sophos XG. It sounds a lot more complicated than it is.

The reason I bring up the issue about the host OS making a bunch of entries in the firewall log is that I think it might be related. I have no idea that the host os is connecting to the wan port of the xg, but it has never caused any issues before so I didn't look into it. Now, no devices are able to connect to the internet. If I go to any device connected to the XG LAN it just says no internet. I can't even access the web GUI of Sophos. If I log into Sophos Central, I can see the logs are full of "Appliance Access Denied" errors coming from 192.168.1.1 going to random addresses such as 192.168.255.255 on random ports. If I go to connected users and sort by source IP address, 192.168.1.1 does not show up there. All of the firewall rules show 0B in and 0B out.

Any ideas?



This thread was automatically locked due to age.
  • Hi Benjamin Adovasio

    Please Post the NAT rule configured on Sophos Firewall and check packet flow under Packet Capture 

    Go to MONITOR & ANALYZE || Diagnostics || Packet Capture  enter string host sophos.com and turn on the Packet Capture 

    Take SSH go to option 4 

    console>tcpdump 'host sophos.com

    console>dr 'host sophos.com 

    Thanks and Regards

    "Sophos Partner: Infrassist Technologies Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

  • Access to 255.255.255.255 or 192.168.255.255 are OK.
    These are broadcasts, every device used to send or request information. You may exclude "device access" from logging.

    First, you have to check direct connectivity.
    -Do you reach the firewall: Are your clients able to ping the firewall (their default gateway) or are you able to open webadmin at the firewall?
    -Is firewall able to reach the ISP-router (def.Gateway for the firewall)


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • I decided to try factory resetting the firewall, but that made no difference. I am unable to connect to the GUI via 172.16.16.16. or the wan port. I am unable to ping the WAN or LAN of the Firewall from either the LAN or WAN. 

  • but you have GUI access before factory resetting the device ...?

    How do you configure the ports at the device and within your virtual environment?

    What do you see with "ifconfig" at the cli?


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.