Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 12 replies
  • Answers 1 answer
  • Subscribers 26 subscribers
  • Views 16816 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to figure out what is blocking specific traffic.

Nick Enslinger

I am a new user to Sophos XG but have experience with other routing equipment, primarily SonicWall. I apologize if this is lengthy, I just want to get all the information out.  I am attempting to figure out why specific traffic is getting blocked but the logs are proving to be useless.

I have a device on my network which is a HDHomerun Prime Tuner. Their software attempts to connect to it via my.hdhomerun.com from a PC on the local LAN. Using any other router, including Sophos UTM 9, I am able to see the device via this process, when using the XG it states that no device was detected. I can connect directly to the device using its IP but for their licensing practice it has to see it via the my.hdhomerun.com detection method.

I currently have IPS and Malware scanning disabled on the default lan to wan rule for testing this issue.

The logging shows nothing dropped, etc for the device IP. I attempted to do a packet capture but found no traffic going to that device IP.

Any suggestions on what to attempt next to get more info as to why something is getting blocked in this process?

Thanks in advance for any help!



This thread was automatically locked due to age.
  • 0 in reply to Nick Enslinger

    HI Nick,

    I guess that rule has no traffic through it. Check the traffic meter situated on the top left, below the FW-rule name. What made it working, was that the plain FW-rule? In that case, create a separate rule to bypass the traffic for this application by defining either source or destination in the respective zones keeping the filters set to "NONE" and place the FW-rule on TOP.

    Thanks

  • 0 in reply to sachingurung

    That rule was the plain rule that made it work, it just took 10 minutes for the device to retry the connection after creating the rule. It doesn't show any traffic in the screen shot, but looking at it now it shows traffic in and out.  This rule is what you describe, no filters, defined specifically for that device to the WAN.  I have enabled IPS, pharming protection, etc back for the rest of my traffic and this rule is still working to allow the service.

    Thanks again for all the help, I'm glad you were able to resolve this!

     - Nick