I really want to like this product, but...

Until they allow multiple regex expressions per single rule this will be a continuing problem. It was brought up multiple times during beta testing and I have already addressed my feelings on that subject so I won't hijack this thread.

Regarding no blocks showing in logging, refer to this thread https://community.sophos.com/products/xg-firewall/f/46/t/15732 by  

billybob, Thanks for the info. I agree with you 100% but now the million dollar question, Will they fix it? It was said so many times on the beta forum that this product was not ready for prime time but ready or not they role it out anyway. I guess that's the price you pay for early adoption and I am more then willing to hang in there and keep using it as long as they fix things in a timely manor and don't make us wait years. I can only hope that the next update due out in Jan-Feb addresses some of this stuff.

how is this going? I have heard only one regex is supported, so I expect it will be necessary to use the 'or' symbol so mush the 'dreashna' items into a single regex....

"Will they fix it" -

That depends on what you call "fix."

*FIX* regex by either adding it to policies or making it actually *work* on the web filter screen so someone *can* allow netflix through? Probably. If not in Jan/Feb then at some point soon. Please lets hope, and for reasons other than netflix.

-OR- do you mean

*FIX* the XG so that it is easier to allow netflix to get through - doubtful.

I've seen folks in this thread and elsewhere lambaste Sophos - the XG and UTM product line - that it is too hard to allow certain streaming services and that it breaks x or y when https filtering is enabled. I really don't think folks realize THAT'S BY DESIGN. Lest we forget, this is *NOT* a product explicitly designed for home use. I love the fact that they are giving it away for technophiles and the like to play with at home, but lest we forget - it is primarily designed as a business product. Compare it to every other enterprise-grade web filter... Cisco, Websense, Edgewave's iPrism - you'll be hard-pressed to find one that will *EASILY* allow the netflix video streaming through without exempting the entire device from policy. Lets be clear: this IS NOT the fault of Sophos or the other vendors. It is primarily that 1) nextflix is NOT a business priority, 2) netflix does NOT make it easy to identify their hosts and thus allow them and 3) mobile devices are NOT very friendly to HTTPS filtering due to the certificate issues discussed previously.

Again - this is NOT a sophos problem. The reason Sophos is getting hammered on it is that they actually encourage home users to use their product. They probably should publish some caveats with that - and some better documentation and better communication, because what they've done is created a bunch of frustrated, upset users. And that is bad and sad.

I keep repeating this bit about HTTPS filtering and other vendors because I think it is an important security issue.... bypassing this "by design" security by allowing netflix through can have severe consequences. If you take a look at the drashna.net rules for a bit, you may be able to see the security issue... and why I believe his post is called an exercise in futility.

ANY firewall - XG, SG, etc - that implements those rules effectively blesses every IP address on the entire net, and only filters based on the "filename" portion of the URL. It would be relatively trivial for a piece of malware to mimic the netflix - and similar video sites - url structures in order to bypass filtering, because there is literally no host/domain name checking on it.

Honestly, based on the URLs I saw going across the wire when I tested - I'm not even sure the drashna rules will work any more - as the URLs I saw in my testing would NOT match those filters... we'll just have to see once Sophos fixes the regex filter.

I will tell you what an unnamed agent at Sophos support told me:
He determined - and whitelisted - a hundred or so IP addresses associated with netflix, and that's how HE got it to work at his house.

sure, netflix may not be a service that a business needs to allow through, but consider it a test case for how well the product supports a tech person trying to accomplish a goal with the product - is there sufficient information in the log to assist with the diagnosis? are the mechanisms provided sufficient to achieve a desired result? Do they behave as advertised, are they predictable and flexible enough for a particular task? many of us have dual lives and to earn our 'yes' vote at work, a home product may do the trick. Or the reverse. I can easily see setting up some cloud service (or hybrid cloud) as causing similar difficulties as netflix. Opportunity is the word, and meeting it by burying one's head in the sand and yelling 'free home product' does not impress me in the least.

Great points by everyone. Now I am excited for the next update.

Thanks to everyone for taking the time to reply...

So how do we get this list from the unnamed agent? Its great when people get things working but sharing is caring

Neal as you can see not very well. We need better support in the Regex department or we going no place.

Regex is needed, definitely