Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 1 reply
  • Subscribers 3 subscribers
  • Views 1964 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Dropped Packets after trying to Configure MS Exchange WAF

sys8dmin

Hi All,

I have been trying to configure MS Exchange WAF set up using UTM FW 9.411-3 and have noticed a spike in dropped packets in my Firewall log. 

I have been following the steps in the 9.3 Exchange WAF guide (from Nov 2015) but it is further complicated as we use a hybrid On Prem and Office 365 set up.

I am thinking of restoring back to before the changes as my normal firewall log size is much smaller.

The dropped packets look to be Citrix servers trying to talk to my UTM on port 80 (172.16.5.31) but I don't recognize the source ports?

2017:03:21-14:17:48 srv-utm1-1 ulogd[11354]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="00:50:56:a4:39:cc" dstmac="00:1a:8c:f0:5c:e0" srcip="172.16.5.50" dstip="172.16.5.31" proto="6" length="52" tos="0x02" prec="0x00" ttl="128" srcport="59915" dstport="80" tcpflags="SYN"
2017:03:21-14:17:51 srv-utm1-1 ulogd[11354]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="00:50:56:a4:39:cc" dstmac="00:1a:8c:f0:5c:e0" srcip="172.16.5.50" dstip="172.16.5.31" proto="6" length="52" tos="0x02" prec="0x00" ttl="128" srcport="59915" dstport="80" tcpflags="SYN"
2017:03:21-14:17:55 srv-utm1-1 ulogd[11354]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="00:50:56:a4:39:cc" dstmac="00:1a:8c:f0:5c:e0" srcip="172.16.5.50" dstip="172.16.5.31" proto="6" length="52" tos="0x02" prec="0x00" ttl="128" srcport="59916" dstport="80" tcpflags="SYN"
2017:03:21-14:17:57 srv-utm1-1 ulogd[11354]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="00:50:56:a4:39:cc" dstmac="00:1a:8c:f0:5c:e0" srcip="172.16.5.50" dstip="172.16.5.31" proto="6" length="48" tos="0x00" prec="0x00" ttl="128" srcport="59915" dstport="80" tcpflags="SYN"
2017:03:21-14:17:57 srv-utm1-1 ulogd[11354]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="00:50:56:a4:39:cc" dstmac="00:1a:8c:f0:5c:e0" srcip="172.16.5.50" dstip="172.16.5.31" proto="6" length="52" tos="0x02" prec="0x00" ttl="128" srcport="59916" dstport="80" tcpflags="SYN"
2017:03:21-14:18:04 srv-utm1-1 ulogd[11354]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0" srcmac="00:50:56:a4:39:cc" dstmac="00:1a:8c:f0:5c:e0" srcip="172.16.5.50" dstip="172.16.5.31" proto="6" length="48" tos="0x00" prec="0x00" ttl="128" srcport="59916" dstport="80" tcpflags="SYN"

 

Thanks,

Mark.



This thread was automatically locked due to age.
Parents
  • +1

    Mark, the source ports will always be random.

    If 172.16.5.31 isn't the UTM itself, it looks like the device at 172.16.5.50 has an incorrect netmask - the UTM shouldn't see traffic between devices in the 172.16.5.0/24 subnet.  If 172.16.5.31 is the UTM, then you need to add a Virtual Server definition on that interface.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • +1

    Mark, the source ports will always be random.

    If 172.16.5.31 isn't the UTM itself, it looks like the device at 172.16.5.50 has an incorrect netmask - the UTM shouldn't see traffic between devices in the 172.16.5.0/24 subnet.  If 172.16.5.31 is the UTM, then you need to add a Virtual Server definition on that interface.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Unfiltered HTML