Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Anyone successfully running Crashplan backups through an XG?

Greetings!


I recently replaced a UTM 120 with an XG 125. Crashplan Pro (usually running on ports 443 and 4242) hasn't worked since. Taking the XG out of the loop allows communication, so it's definitely something with the new unit's config, but even if I allow all traffic out and disable HTTP/HTTPS scanning, it won't communicate. Any suggestions?

Thanks,

Peter



This thread was automatically locked due to age.
  • Since I've got this one working, I now have to reboot my firewall every day.  Coincidence?  Maybe.

    This firewall is MEGA buggy.

  • I've luckily (?) not have the problem with needing a daily reboot. Been running it for almost 2 month now on the same hw as I used for UTM.

    But Crashplan was my big problem.

    I also found some bugs and had lots of questions and comments, which I posted in a seperate post:

    community.sophos.com/.../289202

  • I am also struggling with this. I have set up a firewall rule for an FQDN group (including the host name used by another system at a friend's house) but I still can't connect.

    The web filter log does not show any denied requests. Maybe my problem isn't with XG at all even though it started after switching from UTM 9.

    Shouldn't the log be showing it if XG is blocking CrashPlan?

  • First verify that you have the correct network interface selected for Crashplan (in the app). I've had this change several times on my computer.. maybe because I've been playing around with VPN apps and stuff.. Right now it had shifted again and selected my tap interface, instead of eth6 which was my intel card with my local IP shown.

    Next you should be able to get this to work following my post (answer #3 in this thread) to get it to work. It still works for me, and the app is now v4.7.0

  • Thanks.

    Unfortunately that wasn't the problem, I also have a number of interfaces and all of them were checked. I couldn't get the FQDN group policy to resolve the blocking of Crashplan. But after some experimenting I fixed it by creating a policy allowing unrestricted HTTPS access for the server where Crashplan runs.

    This method should be useful in other cases like this [:)]

  • ... I couldn't get the FQDN group policy to resolve the blocking of Crashplan. But after some experimenting I fixed it by creating a policy allowing unrestricted HTTPS access for the server where Crashplan runs...

     

    Seems I'm back with my old problems after upgrading XG to v16.0.x. I'm not able to connect to CrashPlan Central anymore (app v4.8.0).

    Do you have any advanced settings in that 'CP' rule of yours?

  • There is a bug in v16.x which kills the access to Crashplan Central.

    Forumpost: https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/81482/crashplan-connectivity-issues-with-xg-16/310556?pi2132219853=2&pi2132219849=84

    tl;dr; Workaround until fixed (maybe need to turn it back on, I don't know):

    Just log into console and run this

    console> system application_classification microapp-discovery off
  • I created a walk-through for anyone interested:

    Enable CrashPlan on Sophos Firewall’s - Steps

    1. Disable Microapp Discovery
    2. Create FQDN Group
    3. Create FQDN’s for CrashPlan
    4. Create Firewall Rule

     

    Disable Microapp Discovery

    1.) Connect to the XG firewall via SSH and select option 4 (Device Console) from the menu

    2.) run this command to disable microapp discovery: system application_classification microapp-discovery off

    3.) Reboot Firewall

     

    Create FQDN Group

    SYSTEM>>> Hosts and Services>>> FQDN Group>>> Add

    Name: CrashPlan FQDNGroup

    Description: CrashPlan FQDNGroup

     

    Create FQDN's for CrashPlan

    SYSTEM>>> Hosts and Services>>> FQDN Host>>> Add

    (add each item below)

     

    Name: CrashPlan www.crashplan.com

    FQDN: www.crashplan.com

    FQDN Host Group>>> Add New Item >>> CrashPlan FQDNGroup

     

    Name: CrashPlan web-bbm-msp.crashplan.com

    FQDN: web-bbm-msp.crashplan.com

    FQDN Host Group>>> Add New Item >>> CrashPlan FQDNGroup

     

    Name: CrashPlan reflector.crashplan.com

    FQDN: reflector.crashplan.com

    FQDN Host Group>>> Add New Item >>> CrashPlan FQDNGroup

     

    Name: CrashPlan edf-sea.crashplan.com

    FQDN: edf-sea.crashplan.com

    FQDN Host Group>>> Add New Item >>> CrashPlan FQDNGroup

     

    Name: CrashPlan cxe-sea.crashplan.com

    FQDN: cxe-sea.crashplan.com

    FQDN Host Group>>> Add New Item >>> CrashPlan FQDNGroup

     

    Name: CrashPlan central.crashplan.com

    FQDN: central.crashplan.com

    FQDN Host Group>>> Add New Item >>> CrashPlan FQDNGroup

     

    Name: CrashPlan arb-msp.crashplan.com

    FQDN: arb-msp.crashplan.com

    FQDN Host Group>>> Add New Item >>> CrashPlan FQDNGroup

     

    Create Firewall Rule

    PROTECT>>> Firewall>>> Add Firewall Rule>>> User/Network Rule

    Rule Name: CrashPlan Allow

    Rule Position: Top

     

    SOURCE

    Source Zones* = LAN

    Source Networks and Devices* = Any

     

    DESTINATION & SERVICES

    Destination Zones* = WAN

    Destination Networks* = CrashPlan FQDNGroup

    Services* = Any

     

    IDENTITY

    Match known users (UNCHECKED)

     

    MALWARE SCANNING

    All unchecked

     

    Leave all other boxes alone and SAVE >>> Finished