Unable to update Samsung phone behind xg

If you can't find anything in any logs, then you have to enable logging on the respective Firewall Policies.

Do you use webfilter for instance?

Hi Moeller,

may I ask you to take a look at this post ? https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/46079/google-play-store-issues 

It describes how to create FW rules in Sophos XG for Android OS in detail. Based on this, I created the following network rule which allows me to:

- update Samsung Galaxy 7 adn other Android based devices

- use playstore

- download/update apps in playstore

- use BlueStacks (needs additional Application Filter -> allow -> BlueStacks)

Please find the screenshots attached.

Br,

Sascha

Hi Sascha

I'm able to update anything that has to do with android but the problem is only phone update and not app updates.

The post is from 2014 so cant see how this would still be an issue.

Have enabled logging on every fw rule

Hi

I only block malware sites and newly created domains via webfilter.

Moeller,

use drop-packet-capture "host x.x.x.x" where x.x.x.x is your mobile ip.

From there you should understand the reason why traffic is blocked.

Regards

Hi Moeller , 

Best practice to determine if its an issue with the firewall or not simply creates a plain rule for your mobile MAC address or Host address and user the same policy, disable https scanning or malware scanning and check the drop packets for your mobile. As per Luks suggestion run the tcpdump for your mobile and a drop packet capture for the same 

Command console> tcpdump 'host <Mobile host address > 

Command console > drop 'host <Mobile of host address> and not port 137 and not port 53

Post both outputs when the issue is recreated. Remove the policy by changing to none for a single MAC/Host address of the mobile and check again. 

The phone got updated outside the network, tried with another Samsung model, but couldn't replicate the issue.

Thanks anyway

Hi Aditya

Have justed looked though the logs again, and it looks like it was blocked as malware

URL: http://fota-s3-dn.ospserver.net/firmware/NEE/SM-G930F/10629b

Hello

I personally also use for Samsung (in general) following compressed exceptions...I build/optimized it a while ago from all my various Samsung rules across time. As I use various galaxy devices, Samsung Smart TV's and Samsung wash dryer (Smart Things), the rules might contain some additional webservices not used for Galaxy Updates. I think the first three exceptions should already work for Samsung Galaxy Store and OTA updates, the SmartThings and other exceptions surely might become useful in the future maybe ? ;o))

^([A-Za-z0-9.-]*\.)?samsung(rm|apps|cloud|dm|osp|otn|iotcloud)?\.(com|net)?\/
^samsappsbn\.vo\.llnwd\.net\/
^([A-Za-z0-9.-]*\.)?ospserver\.net\/
^([A-Za-z0-9.-]*\.)?api\.smartthings\.com\/

Excluded from HTTPS scanning, AV and Sandstorm

If it's still blocking, also check IPS and AppControl LOg for possible false positives/blocks too...

Hope that helps

BTW: Why a OTA should be blocked as Malware ? Usually a OTA is a 3 to 4 digit MB download and exceeds the common scansize of 20...50MB and is therefor not scanned or sandboxed by XG anyway? Or is it blocked as malcious url ?

/Sascha

Hi Sascha

Looks like the first two was enough.

Just updated some apps and will try the first to see if that would do the trick alone.

Thanks

/Moeller