This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Allowing TCP -Options through UTM 9

Hi,
I recntly upgraded my Sophos virtual appliance 8 to a virtual version 9 UTM, by exporting and importing the configuration.

Since then my Citrix Repeaters are unable to connect to each other, hence no traffic is accelerated between our companies sites any more.

Citrx technical support claims, this is due to the firewall not allowing TCP-options (options 24 to 31 (decimal) to be precise).
I already disable IPS to be on the safe side, but still no luck.

Is there a way on the UTM9 to allow the forwarding of packets with TCP-options set ?

Regards

Tobias

This thread was automatically locked due to age.

0 BarryG over 11 years ago

Hi,

What appears in the firewall and/or IPS log?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 ToBu over 11 years ago in reply to BarryG

IPS-Log: a few UDP SYN-Flood entries, but none have my Citrix Receiver IP-addresses in their source- or destination-fields

Firewall-Log: No blocked connections to and from my Citrix Repeater machines.

Regards

Tobias
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 11 years ago

Considering #1 in https://community.sophos.com/products/unified-threat-management/astaroorg/f/51/t/22065, also please look in the Application Control log.

Did you install the new instance from the software ISO? Is this ESXi and did you specify the VMXNET3 NICs? Is this running with another instance in Hot-Standby?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 ToBu over 11 years ago in reply to BAlfson

Hi Balfson,

wow, that is cool set of Rulz.
As of rule #1, the applöication control log has 0 Bytes in size, and web protection is niether licensed nor turned on.

I installed a new instance from the ISO-file version 9.109, it is indeed an ESXi, but the interfaces are defined as E1000, not VMXNet3, there is no clustering / hot-standby solution whatsoever in place.

Regards
Tobias
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 11 years ago

Thanks, Tobias. The Rulz really represent the combined knowledge of folks here as well as input from Astaro/Sophos Support - all I did was organize.

The accepted wisdom here is what Sascha Paris recommends.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Allowing TCP -Options through UTM 9

Submitted a Tech Support Case lately from the Support Portal?