Seeing TOR traffic from WAN IP.

Hi Chad,

I think you are having a sporadic issue where the returning traffic is considered as TOR. Any help with the link below?

https://community.sophos.com/products/xg-firewall/f/web-protection/76617/google-ips-are-considered-tor-proxy

Thanks

I thought I had a problem until I investigated and found the destination was the 'i' group of hardware. Once I enabled the Apple exception in the web filters the tor went away and is no longer reported.

This was on the XG not the UTM.

Was the flow originating from IP of the i group devices or from the WAN interface of the firewall?

Was the flow originating from IP of the i group devices or from the WAN interface of the firewall?

Hi,

I have reviewed the XG logs which are not very helpful about which device was source or destination.

I have to assume it was the work iphone because it has management software as well as other stuff that could be seen as proxy type traffic, but could have been the wife's iphone or the ipad. There was nothing the report that I created that showed any traffic from my mac book pro.