PCI Scan failing due to RED Port 3400

Question

Hi all, 
 So my quarterly PCI scan completed overnight and I failed due to Port 3400 being open and in particular having the following problems: 
 SSL Self-Signed Certificate 
 SSL Certificate with Wrong Hostname 
 SSL DROWN Attack Vulnerability (Decrypting RSA with Obsolete and Weakened eNcryption) 
 SecurityMetrics will not allow me to ignore these to pass, so I have to do something. I've read quite a bit about this problem over on the UTM forum, and the guidance seems to be that I need to create a DNAT rule to accept port 3400 from the IP of my RED, and then create a DNAT rule below that to route all other internet traffic to Port 3400 to a null interface. Is that same guidance applicable to the XG? 
 Very surprised this is still a problem. 
 Thanks in advance.

Bill Roland · Accepted Answer

I used this as a template: 
 http://xianclasen.blogspot.com/2016/02/sophos-red-and-pci-compliance.html 
 The difference is the XG doesn't seem to allow you to "do nothing" in the DNAT rule, you have to give it a destination or you can't create the rule. So what I did was create a DNAT rule to allow from WAN, from the static IP my RED is on, and map port 3400 to the internal IP of the XG. Then I cloned this rule, changed the allowed networks from the RED IP to Any, and then created a non-routable IP and sent the traffic to the black hole address. So far it seems to be working, testing port scans from various places show the port as stealth, but the RED can connect just fine.

AllanD · Answer

Switching to XG's wouldn't make sense when we've already invested over $4k in RED devices. Literally have spent more on RED's then the XG310 they are connecting to. 
 I understand the uploading certificates part but there should be a way to assign a SSL certificate on the XG box for RED device use then when one comes online the Sophos servers check the XG, see the certificate, and use that for the RED devices. So there is no uploading to Sophos manually and it gets by this issue "properly". 
 
 Self signed certificates shouldn't be used on anything externally facing and that is what is causing me to fail the PCI compliance scan. And again the work around is not usable when IP addresses can and will change. 
 
 I'll keep working with my scanning company...