Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 27 replies
  • Answers 1 answer
  • Subscribers 30 subscribers
  • Views 2486 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

(XG) VLAN traffic showing up on unexpected interfaces

MBue

Hi all, 

User Kyle Sexson had this issue a while ago, too, but there’s no solution in his post - so… 

I have a set of VLANs running on a bridge interface. 
This works mostly well, but certain outgoing traffic will show up both on the bridge interface and the associated hardware port the traffic source is physically connected to.
This leads to a dropped server response because the router can’t associate it to the correct connection attempt.

E.g. log entry:

2022-12-27 14:50:31

Invalid Traffic

Denied

N/A

0

Port3

172.24.10.16

212.227.17.170

56111

993

TCP

0

1001

Open PCAP

Could not associate packet to any connection.

2022-12-27 14:50:22

Firewall Rule

Allowed

4

3

br0.10

Port4_ppp

172.24.10.16

212.227.17.170

56111

993

TCP

1

1

Open PCAP


My guess is that I’m having issues with a combination of VLAN on a bridge interface and activated “routing on bridge”. 
But the fact that only a certain (reproducible) part of traffic is affected makes me skeptical. The problem is for example triggered when trying to collect mail from GMX.net via IMAP/SSL (see log entry above) or by specific online banking apps. But other mail providers (also called via IMAP/SSL port 993) do work…

Detailed setup is as follows: 
XG106 running 18.5MR5 / Port 3 is connected to CBS350-10
XG106 Port 1-3 are bridged (br0, IP 192.168.2.222) with activated routing option. No DHCP. 
On the brigde, VLANS br0.10 / br0.20 / br0.30 / br0.40 are set up. IP-ranges are 172.24.10 / 20 / 30 / 40 respectively, with DHCPs.
CBS350-10 receives the four VLANs tagged from XG Port 3 and distributes them via untagged access ports (ge0 to ge3, one VLAN each).
Behind these ports are APX120 in brigde-to-LAN mode. 
(Reason is that the APX are in relatively uncontrolled environments and i want to make sure that even if someone detaches an APX and tried to hook up his own stuff, he always will end up in the desired VLAN).

Any input / thoughts very much appreciated! :) 



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to MBue

    Hi,

    linked NAT rules are designed for multiple IPS connections, a single MASQ should cover your general internet access requirements and also make debugging easier.

    Also for firewall rules source LAN, Network VLANx.x network, destination Wan netwoirk, any, service all, log. I would also use the proxy without any decrypt functions, also makes debugging easier.

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

Children
  • 0 in reply to rfcat_vk

    Morning, 
    Ian, first off: thanks for your patience :) 

    My firewall rule set reads a bit different as I have set up the guest VLANs in a separate zone. 
    So it’s source GuestWIFI / Network VLANxx / dest WAN / any host / any service / log.

    As the appliance is not subscribed to Web Protection, the web proxy isn’t an option. 

  • 0 in reply to MBue

    No proxy, that will be your problem trying to stop SSL/TLS trying to decrypt applications because the SSL/TLS exceptions are web based not port based.

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hm. As far as I’ve understood, if the web proxy isn’t enabled in the firewall rules, the SSL/TLS inspection is always carried out by the DPI engine.

    Exceptions for the DPI are defined via “web”->”URL groups” and then enabled via “rules”->”SSL/TLS inspection rules”.
    The “URL Group” field is independent of the Web Protection/web proxy license. 

  • 0 in reply to MBue

    Update:

    even completely disabling the SSL decrypt engine (“rules”->”ssl inspection”->””settings”) doesn’t fix this issue. 

    There’s either some other element in the XG that still intercepts secure traffic, or my appliance has a serious issue and needs a factory reset. 

  • 0 in reply to MBue

    Hi,

    please try a firewall rule at the top

    source LAN network "local network", destination WAN, network any, service all, log, WEB policy, none, Application policy none and IPS lantowan general.

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hi,

    tried around a bit (also with your suggested rule). 
    Added an “allow-all” policy in Web security section to make sure this wasn’t the reason. 
    Tried applying Web proxy, IPS, HTTP(s) scanning to my rule and then removed the tick boxes, to make sure there wasn’t any bugged entry. 
    Added a “don’t touch” rule to TLS inspection. 
    Ran a policy test after each change. 

    Result:
    All rules and options do show up in the policy test as expected (proxy vs. no proxy an so on)

    Still there’s a bunch of sites that are not working. E.g. iCloud Browser Login, IMAPS connection to web.de and gmx.net, certain browser-based online banking sites.

    A policy test returns the following (or similar, if options for proxy etc. were applied)

    Connection
    Test time
    13:31:11 Saturday
    Destination
    imaps://web.de
    Destination IP
    82.165.229.83, port 993, TCP
    Source IP
    192.168.8.225
    Source zone
    Auto-detection
    User
    User unauthenticated
    Firewall rule
    Allow LAN->WAN (ID: 5) Accept
    Web proxy
    Proxy not used
    SSL/TLS inspection rule
    No Decrypt (ID: 2) Don't decrypt
    Decryption profile
    Maximum compatibility
    Result
    Accepted
    (Not decrypted)
  • 0 in reply to MBue

    Hi,

    have you tried accessing the internet directly without the XG eg your PC and check if the applications work correctly? I just tried web.de but not having an account and not speaking German I am not able to test their IMAPS setup. Are you trying to access the web.de mail from a web.de internet connection or via someone else network? gmx.net looks very much like web.de

    Your issue is begining to look like a PC issue.

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hi and happy New Year :) 

    I’m running WAN via FTTH GPON SFP in the XG. But I’ve checked the same applications via mobile phone/personal hotspot.
    Also, the behavior shows across different devices. I’d assume that rules out erroneous client software config. 

    web.de and gmx are quite similar in behavior. 
    web access via browser works just fine. POP and IMAP fail. Both services are hosted by the same provider (oneandone / ionos). Just noticed while typing: I haven’t tried yet to add these domains to the exclusion lists…

    Apple could be related to some domain not being properly excluded, too. You’ve been elaborating on that in a few different threads, right?

  • 0 in reply to MBue

    And you're not getting certificates rejected or anything? Even at the minimal setting for TLS, it will reject malformed, outdated, etc, certificates.

    The common thread in your list (IMAPS, banking sites) is TLS decryption and the app/server rejecting you -- which would not show up in any logs -- because they're not seeing the pinned certificate.Which leads me to wonder if you're not being handed off to a second site -- that you don't disable TLS for -- to do authentication?

    I'd be tempted to put my web browser into Developer Mode and look at the URLs the web page is accessing to see if there's something different in there. Might be blocking the URL (in which case it would be red and not get what it wants) but probably a TLS issue.

  • 0 in reply to Wayne Folta

    Hi Slight smile

    This is exactly what I’m assuming, but I haven’t checked the client side yet, 
    My shots so far all aim at getting the XG to simply ignore TLS traffic as far as possible. 
    I went as far as disabling the complete TLS inspection engine and adding a whole bunch of sites to the web exceptions.. Still same results. 

    My current guess is that something in the options froze when my trial licenses (web protection etc.) expired, and I can’t toggle it anymore. 
    Next try will be a factory reset, just to make sure that there’s no old / bugged config stuck somewhere. 
    Unfortunately, this will happen in about four weeks earliest as I won’t be having physical access to the appliance before that. 

    Will keep this thread open and posted as soon as news arise. 

Unfiltered HTML