How to disable snort_decoder rules?

Hi David,

Please provide me sometime to check this and update you.

Thanks

Appreciate it, Sachin.

Check this out.  The "(snort_decoder) WARNING: IPV4 packet to broadcast dest address" is also firing on 1) IPv6 packets  2) Unicast packets. 

Hi David,

Navigate through the options 

• Objects
• Policies
• Intrusion Prevention

Select the IPS policy applied in the firewall rule for intrusion prevention. And allow the snort signatures. PFA screenshots.

Hope that helps :)

Thanks

Nope, no good.   Note that none of the snort signatures in that list match the rule that is firing.   But, I went and selected all of them, with allow,  just to give it a try and it did not help.  I get several thousand of these a day. 

As in my previous post, it is also triggered by IPv6 traffic and IPv4 unicast TCP/UDP traffic.  Certainly not a rule match for a "IPv4 broadcast".

FYI, I am in bridge mode, if that helps.

Thanks!

Nope, no good.   Note that none of the snort signatures in that list match the rule that is firing.   But, I went and selected all of them, with allow,  just to give it a try and it did not help.  I get several thousand of these a day. 

As in my previous post, it is also triggered by IPv6 traffic and IPv4 unicast TCP/UDP traffic.  Certainly not a rule match for a "IPv4 broadcast".

FYI, I am in bridge mode, if that helps.

Thanks!

Hi... same problem here... as a side effect, my virtual machines running on my macbook (VMWare Fusion or VirtualBox) can not obtain ip address via DHCP if they have nic bridged to airport wifi...

((--)) = wifi

<--> = cable

guest vm nic in bridge mode with macbook wifi ((--)) ap/switch <--> sophos xg <--> main router with dhcp server (not working, blocked by snort_decoder)

If I connect my macbook with ethernet, all it's fine

guest vm nic in bridge mode with macbook ethernet <--> ap/switch <--> sophos xg <--> main router with dhcp server (working)

ema said:

Hi... same problem here... as a side effect, my virtual machines running on my macbook (VMWare Fusion or VirtualBox) can not obtain ip address via DHCP if they have nic bridged to airport wifi...

ema, I think you have a different issue.  Have you seen this KB:  Unable to get DHCP Lease IP after deployment of Sophos XG Firewall in Bridge Mode

Thank DavidWilliams1, but I already have a firewall's (more permissive) rule for that...