This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Missing log items in UTM9 (9.407-3)

Hi,

UTM9 (9.407-3) firewall log may have bug....either the firewall itself or the log feature only.

- Added "allow/ log traffic" rule from any LAN client <-> SIP simulated server.

- Tried to send packets from client to server, by hand using a random packet sender tool, 10 times in a row and there are only one or two of them logged (checked in live log as well as in Logging & Reporting menu).

- At the same time, the packet sender tool show 10 successful send & receive records in both client and server.

I wonder if firewall is doing it job correctly and issues may reside in the log feature only/ itself. This appliance look unreliable since this is done by hand and the UTM missed the logs, imaging if this is carried by a real attack with thousands of packets...

Best Regards,

Duy Huynh.

This thread was automatically locked due to age.

0 sachingurung over 8 years ago

Hi Duy,

Where is the SIP server situated? Is it in the LAN?

Take SSH to UTM and take a PCAP output while sending the packets from the tool. Refer the document here to capture a pcap on UTM.

Thanks

Sachin Gurung
Team Lead | Sophos Technical Support
Knowledge Base | @SophosSupport | Video tutorials
Remember to like a post. If a post (on a question thread) solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 8 years ago

Duy, is there anything in the Intrusion Prevention log file while you were running this test?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Missing log items in UTM9 (9.407-3)

Submitted a Tech Support Case lately from the Support Portal?