How to disable snort_decoder rules?

Hi David,

Please provide me sometime to check this and update you.

Thanks

Appreciate it, Sachin.

Check this out.  The "(snort_decoder) WARNING: IPV4 packet to broadcast dest address" is also firing on 1) IPv6 packets  2) Unicast packets. 

Hi David,

Navigate through the options 

• Objects
• Policies
• Intrusion Prevention

Select the IPS policy applied in the firewall rule for intrusion prevention. And allow the snort signatures. PFA screenshots.

Hope that helps :)

Thanks

Nope, no good.   Note that none of the snort signatures in that list match the rule that is firing.   But, I went and selected all of them, with allow,  just to give it a try and it did not help.  I get several thousand of these a day. 

As in my previous post, it is also triggered by IPv6 traffic and IPv4 unicast TCP/UDP traffic.  Certainly not a rule match for a "IPv4 broadcast".

FYI, I am in bridge mode, if that helps.

Thanks!

Hi... same problem here... as a side effect, my virtual machines running on my macbook (VMWare Fusion or VirtualBox) can not obtain ip address via DHCP if they have nic bridged to airport wifi...

((--)) = wifi

<--> = cable

guest vm nic in bridge mode with macbook wifi ((--)) ap/switch <--> sophos xg <--> main router with dhcp server (not working, blocked by snort_decoder)

If I connect my macbook with ethernet, all it's fine

guest vm nic in bridge mode with macbook ethernet <--> ap/switch <--> sophos xg <--> main router with dhcp server (working)

Uh, the problem seems to has fixed itself.   All the erroneous "IPv4 broadcast" packet drops have stopped. 

It seems to coincide with the outside interface (I'm in bridge mode) bouncing because the upstream router was restarted. 

The last bad message was just before I see the IPv4 / IPv6 gateway up log messages.  After that, no bad snort hits.  Interface reset cause the snort rules to reload?

 Weird things going on here.

ema said:

Hi... same problem here... as a side effect, my virtual machines running on my macbook (VMWare Fusion or VirtualBox) can not obtain ip address via DHCP if they have nic bridged to airport wifi...

ema, I think you have a different issue.  Have you seen this KB:  Unable to get DHCP Lease IP after deployment of Sophos XG Firewall in Bridge Mode

Thank DavidWilliams1, but I already have a firewall's (more permissive) rule for that...