XG Firewall and Netflix

Hi,

you could try to refer on this: https://community.sophos.com/kb/en-us/125061

let us know of the results,

Thanks,

Rap

Hi,

you could try to refer on this: https://community.sophos.com/kb/en-us/125061

let us know of the results,

Thanks,

Rap

Hi,

Thanks, I have followed that link, it is very similar as to what Aditya wrote, it has made no difference.

Thanks

hi daniel,

I can see that the info didn't work, thanks for the feedback, thus kindly try creating a firewall like this: 

and create a clientless user for the specific IP range that would access netflix.

This did the trick for us, kindly let us know how it goes for you.

regards,

Rap

Thanks, I will try this but if you don't mind do you mind stepping me through the creation of the clientless user too as I have not had much experience with the XG as of yet.

Cheers

hi henry,

what version of sfos are you currently running?

thanks

SFVH (SFOS 16.05.5 MR-5)

please refer to this kb in creating clientless users: https://community.sophos.com/kb/en-us/123039

let us know how it goes

regards

Rap

Thanks Rap,

So I created a clientless user as per your KB, thank you. It was in a different place than the KB.

Configure --> Authentication --> Clientless Users

I created it as Apple TV - Username ATV - IP address 192.168.1.111 - Clientless Open Group - Traffic Shaping: High Guarantee User - Quarantine Digest: Disable

I then created a User/Network Rule:

Position Top (as i am pretty sure the XG reads Top to Bottom)

Source Zone: LAN

Source Network: Home (192.168.1.0/24)

Destination Zones: WAN

Destination Networks and Services: Any

Identity - Match Known users with "ATV" listed as a user or group

All Malware scanning unchecked

All advanced set to "none" with only NAT & Routing as Rewrite Source address

Log Firewall Traffic: Checked

Does that look correct to you? If so, I will give it a try.

Thanks!

hi Daniel,

kindly edit the destination network, your current setting is "any" it seems all outbound traffic will pass through this rule and supersede bottom firewall policies,

hence, put the ip address of netflix in the destination network or fqdn instead of any.

let us know how it goes,

regards

Rap 

Hi Rap,

Thanks for the pickup but Netflix uses multiple IP's and multiple FQDN's so how did you achieve this as I am unsure how I can put one single IP address into there?

when you configured a fqdn, xg would automatically resolve all ip that associates with netflix. give it a try, let us know how it goes

regards

rap