Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 31 replies
  • Subscribers 38 subscribers
  • Views 110409 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SFOS V17 - Microsoft Update and Xbox Download Issues

ShawnGilronan

I recently upgraded my SFOS software to v17.0.0 GA from 16.05.8MR-8.  After upgrading, I was not able to run ANY updates from windows, let alone the anniversary updates people have had issues with lately.

Additionally, I thought my Xbox One X had died, after just getting it.  I had a bunch of patches to install for various games, and all of them were failing to install, until I connected the dots to the windows updates failing on all of my PCs as well.

Here's the curious part, after analyzing both the Xbox One downloads, as well as the windows updates, I noticed that all of the updates and downloads crashed out at the 2 GB mark.  It was easy to trace with the Xbox, as it gives you a running total of the current download.  However I ran the real-time logs through Sophos as well, and noticed every time the download hit the 2GB mark, it would be killed.

I set the exception for Microsoft Windows Update to ON for the Web Exception filtering, however it had no affect on the problem.

Why would Sophos kill any downloads from Microsoft that hit the 2GB mark?  What is special about that file size?  I did not have this problem with any other files of larger sizes.  I moved a bunch of my movies up to my google drive and onedrive, and was able to pull them back down no problem.

I would love to upgrade (again) to v17, however until this problem is resolved, I'll stick to v16.5.



This thread was automatically locked due to age.
  • 0 in reply to BrianHawkins1

    I haven't created any special NAT/fwding rules for xbox, but in all the years i have been running xbox360 and xbone behind my FW i never seemed to need it. Everything worked nicely and I have been buying/downloading games on the platform for years now. That was until a few weeks ago, when i purchased some new titles and none of them (or even any larger updates for existing ones) seemed to install. I first suspected some HDD issues on the console; since the titles were of the play-anywhere type i wanted to install them on my PC - that's when i noticed that they weren't loading there either ...

    I always figured, the NAT forwarding was only really necessary for online gaming - which i hardly ever used. Also when I hook the xbox directly into the network of my provider-router the downloads seem to run just fine and there's also no FWding setup and i deliberately switch off UPNP on my routers ...

    I will give it a try when i find some time, but honestly, i hope sophos fixes that issue because from my point of view, there must have gone something wrong on their end.

    But thanks for the quick help anyway!

  • 0

    Wow. What a mission. I even factory reset my XBox One before stumbling my way into this thread. For me the work around was to create a new LAN to WAN firewall rule right above the original. In the identity section of the new rule I turned on Match Known Users and added my Xbox's group (it was already part of a special clientless open group). Then I removed the Web Policy for this rule.

    Luckily I pay extra to my ISP for unlimited downloads...I have a whole lot of games to re-install now!

  • 0 in reply to Donatas Sirvinskas

    This doesn't look like it was resolved in SFOS 17.0.3 MR-3.

    https://community.sophos.com/products/xg-firewall/b/xg-blog/posts/sfos-17-0-3-mr3-released

    Any updates? I'm seeing the same behavior downloading games on the PS4 and watching Netflix on an Amazon Fire TV.

  • 0

    Same issue here running SFOS 17.0.3 MR-3 and trying to download anything to the Xbox over 2GB.

  • 0 in reply to Dave Pokrifchak

    I’m running MR-3 as well and I am not experiencing any issues downloading files over 2GB. I just downloaded a 52GB game with no issues. I have my Xbox One X assigned to its own firewall rule with no web, application or IPS policies (they’re all set to ‘None’). I also have HTTP Scanning disabled.

  • 0 in reply to Dave Pokrifchak

    There is a bug when handling range requests (files broken down into smaller chunks downloaded separately) and file sizes over 2GB.

    This will be resolved in 17.0 MR5.

    There are no issues in downloading file sizes over 2GB when doing full file downloads or when the file is not broken down using range requests.  Some applications/sites break down large files in other ways.

     

    The workaround until then is to create a higher level firewall rule for service Web and destination network of just that site.  Be sure to remove the workaround after MR5 is installed.

  • 0 in reply to Michael Dunn

    Thanks for the update! I'll be watching for MR5 release.

  • 0 in reply to Michael Dunn

    Michael,

    Could you please be more specific on the workaround you are suggesting?

    This bug also appears to be blocking the download of Windows Updates on WSUS server in addition to Standard Windows updates. I would simply like the best way to allow this on an entire domain until MR5 is released and hopefully resolves this. 

    Thanks!

    Ryan

  • 0 in reply to RyanE
    For Standard Mode, you need to configure the clients not to use the proxy for the internal WSUS server. How you do this depends on how you are configuring your clients.
     
    The following steps are for Transparent Mode:
     
    Go to hosts and Services, IP Host (or FQDN Host).
    Add an entry that specifies your WSUS server.
    Add a firewall rule
    Source Zone LAN, Network Any
    Destination Zone LAN (or wherever zone the WSUS server is), Network is the Host entry you created
    Services is HTTP and HTTPS
    Match known users off
    Scan HTTP and Decrypt and Scan HTTPS both unchecked
    Web Policy None.

    So you are creating a firewall rule from your clients, only to the WSUS server, it applies to HTTP and HTTPS (port 80 and 443 traffic) but it does do anything that requires the httpproxy - so it is passed through without going through the proxy.  Make it higher priority than your main web rule.
     
    You can also go into the log viewer (top right) and switch to Policy Test tab.  You should see there is no Web section in requests to your wsus server.
     
    This is the generic mechanism any time you want traffic to completely bypass the web proxy.
     

    I have no exact date on the MR5 release, but I think it will be within the next 2 weeks.