This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Generally Accepted Safe/Best Practice Inbound/Outbound Rules?

Hey fellas,

The firewalls I recently replaced with UTMs performed no outbound filtering. I love the new UTMs but I am finding the administrative burden of creating a rule for every bit of traffic is killing me. For example, I allowed Pandora via Application Control, but the UTM still blocks the iPhone app, which then requires its own rule.

Are there any generally accepted safe rules that most admins put in their UTMs firewall rules? I don't want to blanket allow all outbound/inbound traffic, but it just seems nuts that I need 60 rules for basic internet/app usage.

Thanks!
Jim

This thread was automatically locked due to age.

0 BarryG over 11 years ago

You'll need to watch these logs:
HTTP Proxy aka Web Protection
Firewall
IPS
Application Control

If the Web Protection is blocking, you may need to create exceptions.
Post entries from the logs.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 11 years ago in reply to BarryG

Excellent, will do. Headed to that site Monday with an iPAD to dig deeper.

Thanks!
Jim
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 11 years ago in reply to Jimstigator

Barry,

Here are some lines out of the Web Protection log.  WP seems to be whats causing the errors - when I turn it off, the iDevices have no issues.  I went on site and confirmed my laptop and Android phone work fine, but all Apple devices have issues.  Kind of blows my mind this isn't a problem everyone has.

Anyway, I added a very basic exemption for "www.cnn.com" which kind of helps... gives errors during advertisements but then plays the actual video.  There has to be a better method.  Do people really add in hundreds of websites to get their iPhones working with Web Protection turned on

As for the WP config, very basic.  Turned on, AV is on.  Block "Suspicious" websites, and Nudity.  I use "Transparent mode".  Confirmed "Bypass content scanning for streaming media" is checked.

Really appreciate the help!
-Jim

log.zip
Cancel
Vote Up 0 Vote Down

Cancel
0 JonEtkins over 11 years ago

Jim,

I don't see any thing being blocked in that log excerpt - everything is "Pass". Was this captured while you were experiencing the problem?
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

Hi, try disabling the A/V as a test.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 11 years ago in reply to BarryG

Barry - that was it. AV is catching it. When turned off, streams on iDevices work fine. What can I do to fix this? I changed the scan engine to Avira and it still gets blocked.

Is the only resolve to run with the AV off? Half the reason I got the UTM was for the AV protection.

-Jim
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 11 years ago in reply to Jimstigator

jetkins - Agreed... it all looks like passes.
Cancel
Vote Up 0 Vote Down

Cancel
0 JonEtkins over 11 years ago

Sanity check: do you have the "Bypass content scanning for streaming content" box checked under Web Protection --> Web Filtering --> Advanced? It's enabled by default, but perhaps it got turned off.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jimstigator over 11 years ago in reply to JonEtkins

Yes, it is checked. Also confirmed today this behavior exists at all sites. Take an iPAD or iPhone to any site protected by a UTM, using just the default protection methods), and it can't access a video on CNN. I can't believe this hasn't come up before in the forums?

-Jim
Cancel
Vote Up 0 Vote Down

Cancel
0 JonEtkins over 11 years ago

Perhaps CNN (or more likely, Apple) is using some new or unusual streaming protocol that is not caught by that exception. If you have a support contract, it would be worthwhile raising this with Sophos. If not, or in the meantime, perhaps you could try the 9.2 beta, add an exception rule if you can identify a particular pattern to the URLs, or even add an exception for the entire site if it's only affecting CNN.
Cancel
Vote Up 0 Vote Down

Cancel