Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 1 subscriber
  • Views 4713 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Client Firewall active location detection failing

Starkadder

Hello,

I'm having problems getting the Client Firewall (from Endpoint Security & Control 9) to recognize the primary location. No matter how I specify this, my laptop clients always believe they are on the Primary Location, even when the user leaves the office and uses the systems at home.

We have a fairly large WAN connected by leased lines and all served by an Active Directory DNS service. On every site our DNS refers back to the server we use to distribute our Sophos Policies. That system does not have a public IP address as it is hidden behind our firewall.

In the central configuration policy for the Firewall I am setting the Location detection by DNS. My belief being that the FQDN and IP address combination I have entered is always correct when my clients are within our network and will fail to to resolve when they are on foreign networks (like their own broadband connections). I should then be able to configure the firewall to behave differently depending upon it finding the primary location or not.

Now I'm probably doing something wrong here, but no matter how I specify the policy servers IP address, my firewall clients are always showing that the active location is the Primary location. Even when used out of the bounds of our LAN/WAN.

I have made various tests to confirm that the DNS resolution is not the cause of this and this always seems to be fine.

Has anybody else seen this behavior, or can you suggest what I may be doing wrong?

Is there a comprehensive Firewall Configuration guide available? I haven't been able to locate one as yet.

Many thanks in advance,

Paul

:1881


This thread was automatically locked due to age.
Parents
  • 0

    Hello Paul,

    my firewall clients are always showing that the active location is the Primary location [...] I have made various tests to confirm that the DNS resolution is not the cause.

    How did you check? I'm asking 'cause I don't have any issues. That is - I used to think so. Just noticed some problem and I'll perhaps engage support (but it's not a general problem and about detecting the primary location). Whenever an adapter is "activated" a corresponding entry should be found in in the firewall log (System Log): Detected location as ....  (often first as secondary and after a few seconds as primary). Of course the SCF settings should be verified on the client (I'm quite sure you did but after all those years in IT I'd rather ask a second time you sure the power cord is plugged in? than not asking at all). Oh - and they don't have a VPN connection or something like it?

    Re-checked that a hosts or lmhosts entry doesn't affect detection.

    In case the community is as clueless as I - there's always Sophos Support.

    [Edit:] Searching the knowledgebase for firewall and configuration gives quite a number of hits. If a version is mentioned it's 1.5 but not 2.0.1. Both User manuals and Release notes are about 1.5. Only the ESC9/SEC4 manuals contain information about the current version. And the SEC4.0 manual says: For a full list of the default firewall settings, see Sophos support knowledgebase article 57756 (http://www.sophos.com/support/knowledgebase/article/57756.html) - it doesn't seem to exist.

    Christian

    :1893
Reply
  • 0

    Hello Paul,

    my firewall clients are always showing that the active location is the Primary location [...] I have made various tests to confirm that the DNS resolution is not the cause.

    How did you check? I'm asking 'cause I don't have any issues. That is - I used to think so. Just noticed some problem and I'll perhaps engage support (but it's not a general problem and about detecting the primary location). Whenever an adapter is "activated" a corresponding entry should be found in in the firewall log (System Log): Detected location as ....  (often first as secondary and after a few seconds as primary). Of course the SCF settings should be verified on the client (I'm quite sure you did but after all those years in IT I'd rather ask a second time you sure the power cord is plugged in? than not asking at all). Oh - and they don't have a VPN connection or something like it?

    Re-checked that a hosts or lmhosts entry doesn't affect detection.

    In case the community is as clueless as I - there's always Sophos Support.

    [Edit:] Searching the knowledgebase for firewall and configuration gives quite a number of hits. If a version is mentioned it's 1.5 but not 2.0.1. Both User manuals and Release notes are about 1.5. Only the ESC9/SEC4 manuals contain information about the current version. And the SEC4.0 manual says: For a full list of the default firewall settings, see Sophos support knowledgebase article 57756 (http://www.sophos.com/support/knowledgebase/article/57756.html) - it doesn't seem to exist.

    Christian

    :1893
Children
No Data
Unfiltered HTML