Crashplan Connectivity Issues with XG 16

Question

Since upgrading today to XG 16 (not beta) Crashplan hasn't been working. 
 It doesn't seem to connect. 
 I've checked the rules and the IP has no extra features turned on (Malware/Webpolicy) it's statically bypassed 
 I tried turning off IPS and no luck, also the firewall shows the traffic green (allowed) out? 
 
 So with this version Logging is improved which is great! So found out that It's an invalid traffic issue?

2016-10-11 11:02:55

Invalid Traffic

Denied

-

0

PortB

-

162.222.42.64 :TCP(443)

01001 
 Anyone could help me here with that? thank you! 
 Regards

ReeceHockley · Answer

Hi Enigy, 
 I'm glad I've been subscribed to the BETA forums, Looks like they have found the issue and are working with Dev to fix it or at least sort something else. 
 They also list the info to stop that happening and a KB is due to come out. 
 
 You can find it all here: 
 
 https://community.sophos.com/products/xg-firewall/v16beta/f/sfos-v16-beta-issues-bugs/79608/crashplan---unable-to-connect#pi2132219853=3#310356 
 
 But for a quick look: 
 
 Workaround: 
 console> system application_classification microapp-discovery off 
 
 Regards

sachingurung · Answer

Hi, 
 XG does not require a WAN_LAN rule as it is a stateful-inspection firewall. 
 I would again recommend you to create a FW-rule on TOP like: 
 Rule Name = CrashPlan 
 Identity 
 
 Match rule based on user Identity = Off 
 
 Source 
 
 Zone = LAN 
 Networks = Any 
 Service = Any 
 Schedule = All The Time 
 
 Destination 
 
 Zone = WAN 
 Networks = ANY 
 
 Action = Accept 
 Routing = Default (Masq) 
 Malware Scanning = Default (off) 
 Policy for User Applications 
 
 Application Control = None 
 Web Filter = None 
 Intrusion Prevention = None 
 Traffic Shaping Policy = None 
 
 Log Traffic (optional) 
 Security Heartbeat = Off 
 Thanks

Joel Hilliard · Answer

Just stumbled upon your thread, as I have been searching for a couple days. 
 I used splunk to analyze the logs and found also that the outbound connections to crashplan.com were allowed but the inbound was denied as invalid traffic. 
 I found a temp fix, it involves disabling a granular application control feature (this is a server network, so no application policies applied)... but I have crashplan working now: 
 I followed the quick step in this workaround, and within seconds it connected and synced. 
 https://community.sophos.com/kb/en-us/125458 
 Looking forward to the next fix... such a great product.

sachingurung · Answer

Hi Dave, 
 Configure a plain FW-rule for the destination URL address that the CrashPlan connects with. Refer my post in the link below and in the destination network define the required FQDNs. I resolved a case using cxe-sea.crashplan.com as an FQDN. 
 https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/81482/crashplan-connectivity-issues-with-xg-16/308230#308230 
 Thanks