Outbound TCP Rule

Hello LookOut,

which SESC/SCF version and which Windows version on the endpoint? I've added such a rule (although one normally doesn't specify a local address) and it is triggered correctly. Do use a secondary location?

Christian 

Christian,

Thank you for the reply.

I am using version 10.3 of SESC and version 5.2.1.197 of SEC.

This is running on Windows SBS 2011.

Any suggestions would be appreciated.

Just out of curiosity, I ran a "whois" search for the ip addresses that generated the firewall events.  Every one of these addresses is owned by Amazon.com.

I'm not sure what that means, but it is definitely not a coincidence.

Terry

Hello Terry,

running on Windows SBS 2011

this isn't the endpoint, is it? SCF is not available for server grade OSs.

Thinking about it - No global rule is an odd result. Do you use application checksums? Which activity triggers these events? owned by Amazon.com - the address you've posted resolves to an amazonaws.com name, part of Amazon's cloud services, nothing unusual, used by many vendors including Sophos.

Christian

Christian,

All of the information I have provided is from the Sophos Enterprise Console running on the server.

The current configuration is not using Checksums.

I am not sure what activity triggers these events.  I have included a screen shot of the Firewall Event Viewer.  Is there another place to look to see what application is involved with these events?

Thank you very much for all your help.

Terry

Hello Terry,

it's the OS of the endpoint sending the alerts which might be relevant.

Anyway, I think the No global rule is only issued when no application is involved, i.e. the connection is made by "system" (wonder where it wants to connect to and what it could be). Still this does not explain the event assuming the rule is active. How many endpoints are generating these events? Did you check that the endpoints comply with the policy and the rule is configured (and enabled) on them?

Christian

Christian,

Just out of curiosity, I checked the firewall events for one particular computer and compared that to the event viewer of that same computer.  For each Sophos firewall event (outbound tcp), windows created an entry in the event viewer at virtually the same time (within a few seconds of each other).

Each event was logged as Event ID 4672 (Special Logon) and the details section showed Sophos as the related program.

Is the "No global rule" event related to something that Sophos itself is doing?

Almost all of the computers on our network have logged a firewall event with the "No global rule" for outbound TCP.

I double checked to see where the endpoints were getting their updates and each computer points back to the server.

Any thoughts??

Thank you for sticking with me on this problem.

Terry

Hello Terry,

before going into the details I'd like to reassure I understand the whole picture and ask for some additional information: SCF is apparently working (if perhaps not as expected), users can browse with no events being generated (and the client log showing allowed connection with Outbound TCP Rule, or whatever its name, as reason) but you get this unexplainable No global rule? I also see at the bottom of the screenshot an event for TCP IN from a private address which seems a little bit odd. What modifications did you make to the default policy BTW? Last but not least - which Windows version is on the endpoints?

Event ID 4672 ... Sophos as the related program

4672 does AFAIK not list a program. It is usually issued when AutoUpdate checks for updates (are you updating from a UNC or a HTTP location?) and logs on the SophosSAUcomputername0 account (you should be able to correlate these events with the update times from the updating log). Which is first (i.e. earlier) - the Security or the SCF event?

Anyway - are these connection attempts eventually blocked or allowed (you'd have to check the client log on the endpoint)? The other events around this time (whether block or allow) might hint at what's actually going on.

So far I don't see an error on your side - but then, there are still some pieces missing. Do all your clients report this event (and how frequent). if not - could the few have something in common? One thing to try though - uncheck (remove) the local address from the rule, shouldn't make a difference but who knows.

Christian