Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 7 replies
  • Answers 2 answers
  • Subscribers 29 subscribers
  • Views 1296 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Denied packets when accessing Sophos XG GUI

Kyle Hesser

Working with Sophos XGS 126.

Whenever I access the Firewall's GUI, which I can access fine, I notice that multiple Denied Packet are being logged. I am not sure if this is normal behavior, and I haven't noticed this before we updated to the SFOS 19.5.0 GA-Build197. I do not know for sure if this was happening before the firmware upgrade, but I am noticing similar packets on our other Sophos Firewall. I just want to make sure my configuration is correct on the firewall. There are no restrictions setup when trying to access devices on the LAN. 

Any ideas? 



This thread was automatically locked due to age.

Top Replies

  • in reply to rfcat_vk +2 suggested

    Basically this is normal. 

    In a normal communication, there is a server and a client. If one of both wants to close the connection, you basically send a RST packet to the other end. But most applications "burst" this RST packets - Means there are 1-X amount of the same packets. 

    A stateful firewall will take the first RST packet to clear its conntrack table. So SFOS will take the first packet and flush the connection. But if there are 2-X more of the same packets, SFOS will not find a related connection and therefore drop the packet. It is basically useless overhead traffic. 

    Most firewalls are not logging this traffic. You can disable invalid traffic logging as well. 

    Then there is the other part of invalid traffic. After X hours, most server/clients will check there connection tables and clear the idle connections. If there are idle connections, it is usually the case to send a "please flush your table" packet (RST or FIN) to the client/server. SFOS will clear/flush the table every 3 hours with now packets. But some servers are using 6-24h to do this cleanup. This packet is basically not important. 

    About the first reason: If there is a "reason to close the connection" (for example, you enter the wrong credentials and the app wants to close the connection), this can lead to the same invalid traffic. 

    Jump to answer
Parents Reply Children
No Data