Hello,
I am pretty new to the Sophos devices, and have been struggling to get answers on why we are seeing some dropped traffic. I've put in support cases on the issue, but they've not been able to help me.
I'm seeing a lot of dropped packets between our Exchange server and remote devices over port 443, but lately it's been causing issues with some tax software we utilize.
I'm using the console to monitor the drop-packet-capture command. The packets are dropped as "Invalid Traffic" and most do not contain any specific fw_rule_id, policytype, or other identifying information as follows;
l4_protocol=TCP source_port=62202 dest_port=443 fw_rule_id=0 policytype=0 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=0 cluster_node=0 inmark=0x0 nfqueue=0 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_fix=0 ctflags=0 connid=0 masterid=0 status=0 state=0 sent_pkts=N/A recv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran_dst_ip=N/A tran_dst_port=N/A
However, some of the traffic I've logged actually shows policytype=2 which seems to indicate some sort of IPS policy was applied, but the IPS log from the web interface does not show any corresponding traffic. I do not have any IPS policies applied on any firewall rules;
l4_protocol=TCP source_port=46733 dest_port=443 fw_rule_id=0 policytype=2 live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=5 app_id=100 category_id=1026 bandwidth_id=0 up_classid=0 dn_classid=0 source_nat_id=1 cluster_node=0 inmark=0x0 nfqueue=100 scanflags=0 gateway_offset=0 max_session_bytes=0 drop_fix=0 ctflags=1208485889 connid=1306160384 masterid=1306162464 status=398 state=4 sent_pkts=N/A recv_pkts=N/A sent_bytes=N/A recv_bytes=N/A tran_src_ip=N/A tran_src_port=N/A tran_dst_ip=N/A tran_dst_port=N/A
I'm pretty frustrated at this point and just hoping somebody can help me. The Sophos XG has some pretty nice features, but these have not at all been worth the headaches it's caused so far.
Thanks.
This thread was automatically locked due to age.
