Seeing TOR traffic from WAN IP.

Hi Chad,

I think you are having a sporadic issue where the returning traffic is considered as TOR. Any help with the link below?

https://community.sophos.com/products/xg-firewall/f/web-protection/76617/google-ips-are-considered-tor-proxy

Thanks

I thought I had a problem until I investigated and found the destination was the 'i' group of hardware. Once I enabled the Apple exception in the web filters the tor went away and is no longer reported.

This was on the XG not the UTM.

Would the IP of the traffic be my WAN IP though. I would figure that the IP of the device originating the request would be the IP shown in Flow Monitor???

Was the flow originating from IP of the i group devices or from the WAN interface of the firewall?

Hi Chad,

Which protection mode is configured: standard or transparent?

Thanks

Hi,

I have reviewed the XG logs which are not very helpful about which device was source or destination.

I have to assume it was the work iphone because it has management software as well as other stuff that could be seen as proxy type traffic, but could have been the wife's iphone or the ipad. There was nothing the report that I created that showed any traffic from my mac book pro.