Printing delayed - invalid traffic in log viewer

Hello Dan Williams ,

Good day and thanks for reaching out to Sophos Community, hope you are well

are there any drop traffic from printer in Intrusion Prevention > DoS attacks? If yes can you add printer in DoS bypass rule

If this would still persist kindly create a support ticket for this and please share to us via DM or by replying to this thread. 

Many thanks for your time and patience and thank you for choosing Sophos

Cheers,

Hi.

Log viewer for IPS/ATP/etc shows nothing at all to explain the dropped packets. No DoS etc recorded.

I have an ACL that allows all traffic outbound from the printer IP with no filters/web policy/IPS...

Exclusion set on the URL and IP of the printer server.

TLS/SSL inspection switched off.

I tried the following; Sophos Firewall: Bypass a specific firewall rule for application classification and ATP

Everything else on the customers network working perfectly.

Plug the printer in to a draytek and it works first time.

I'll log a support ticket and see if they can see anything.

thx

Dan

Hello thank you for your update, please do share with us the generated caseID via PM or by replying to this thread. 

Many thanks for your time and patience and thank you for choosing Sophos

Cheers,

Hi. Case is 06409644 

Support have pretty much disabled all filtering for a rule that matches that source IP of our printers out to the WAN/Internet.

We have now tried to disabled the firewall acceleration but this doesnt seemed to have helped at all.

The customer continues to connect printers to the internet via another manufacturers router/firewall to get around the issue but this is not ideal.

Regards

Dan

Hi Dan,

Thank you for sharing the case ID. Upon checking the case update, they request an update on the status.

I'll put a note on the update you've posted here. 

Hi Dan,

Thank you for sharing the case ID. Upon checking the case update, they request an update on the status.

I'll put a note on the update you've posted here.