phispon 3 doesn't block

Hi Yasin,

First, make sure that the patterns are up2date.

Take SSH to the XG and go to option 4. Device Console, and execute show ips-settings. Check the following parameters,

1. What is the maxpkts value configured for IPS in the backend? You need to set this value to 80, by executing the following command in console,
   set ips maxpkts 80.
2. Is Micro-App Discovery enabled? If it is off then execute the following command in console,
   system application_classification microapp-discovery on

Make sure that Phispon doesn't pass through a different firewall rule; incorrectly configured. If everything's at its place then raise a support case to get the application signature update.

Thanks

its not blocked.you have another suggestion?

Hi Ediz, 

If the patterns are up2date and the IPS-settings are correctly configured then you need to contact support or wait for the signature update which will block it automatically after the pattern update. 

Thanks

Hi Ediz, 

If the patterns are up2date and the IPS-settings are correctly configured then you need to contact support or wait for the signature update which will block it automatically after the pattern update. 

Thanks

EDIT: If you have a support contract, please call support as sachin suggested.

Otherwise changed the ips maxpkts to 100 from console to analyze more packets for better application classification. Keep in mind that increasing ips maxpkts have caused latency issues in previous releases.

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/96461/solved-sophos-allowed-always-psiphon-3-proxy/352035#352035