Denied packets when accessing Sophos XG GUI

Question

Working with Sophos XGS 126. 
 Whenever I access the Firewall's GUI, which I can access fine, I notice that multiple Denied Packet are being logged. I am not sure if this is normal behavior, and I haven't noticed this before we updated to the SFOS 19.5.0 GA-Build197. I do not know for sure if this was happening before the firmware upgrade, but I am noticing similar packets on our other Sophos Firewall. I just want to make sure my configuration is correct on the firewall. There are no restrictions setup when trying to access devices on the LAN. 
 Any ideas?

LuCar Toni · Answer

Basically this is normal. 
 In a normal communication, there is a server and a client. If one of both wants to close the connection, you basically send a RST packet to the other end. But most applications "burst" this RST packets - Means there are 1-X amount of the same packets. 
 A stateful firewall will take the first RST packet to clear its conntrack table. So SFOS will take the first packet and flush the connection. But if there are 2-X more of the same packets, SFOS will not find a related connection and therefore drop the packet. It is basically useless overhead traffic. 
 Most firewalls are not logging this traffic. You can disable invalid traffic logging as well. 
 Then there is the other part of invalid traffic. After X hours, most server/clients will check there connection tables and clear the idle connections. If there are idle connections, it is usually the case to send a "please flush your table" packet (RST or FIN) to the client/server. SFOS will clear/flush the table every 3 hours with now packets. But some servers are using 6-24h to do this cleanup. This packet is basically not important. 
 About the first reason: If there is a "reason to close the connection" (for example, you enter the wrong credentials and the app wants to close the connection), this can lead to the same invalid traffic.

ErickJan · Answer

Hi Kyle, 
 Thank you for reaching out to Sophos Community. 
 For invalid Traffic, you may refer to the following KB. 
 community.sophos.com/.../sophos-firewall-invalid-traffic

Denied packets when accessing Sophos XG GUI

Top Replies