This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG constantly querying Google domains, why?

Hi all,

First post here, hopefully I can be a contributing member of the communty. For now I have a question for you guys.

I'm slowly getting round to setting up Sophos XG Home to replace my router. It's currently connected to my home network via it's WAN port, with the LAN port creating a new network on the backend for testing. The WAN link is assigned an IP address etc via DHCP from the current router. I have recently setup Pi-Hole with Unbound which is handling all DNS queries on the primary LAN.

The question is as described in the subject. Why is Sophos XG constantly querying Google domains? I have made sure there is nothing else on the LAN side of the Sophos VM.

Call me paranoid, but i dont like the idea of anything on my network having constant communication with Google, or anything else for that matter, certainly without me knowing.

Does anyone have any ideas why it's happening, and whether I can stop it?

TIA

TheBeardedOne

This thread was automatically locked due to age.

Parents

0 TheBeardedOne over 5 years ago

I'm also seeing the below in the Sophos logs... Seems to coincide. Could XG be trying to use Google to do a look up for the IP's trying to connect? I can't imagine that being the case but it's all i can comeup with for now.

I've checked each IP listed and they're all linked to Cyren Inc/Commtouch.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 TheBeardedOne over 5 years ago

I'm also seeing the below in the Sophos logs... Seems to coincide. Could XG be trying to use Google to do a look up for the IP's trying to connect? I can't imagine that being the case but it's all i can comeup with for now.

I've checked each IP listed and they're all linked to Cyren Inc/Commtouch.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 TheBeardedOne over 5 years ago in reply to TheBeardedOne

Found another discussion regarding Commtouch\Cyren...

https://community.sophos.com/products/xg-firewall/f/logging-and-reporting/101128/commtouch-ip-addresses-being-blocked-by-xg

There doesn't seem to be a conclusion or fix however.

If anyone can explain any of this it'd be greatly appreciated.

Best regards

TheBeardedOne

EDIT: These two issues aren't linked. After changing the DNS server on the Sophos to Google DNS the logs on the Pi-Hole stopped coming through, but the logs on the Sophos relating to Commtouch\Cyren continue to come through thick and fast.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 5 years ago in reply to TheBeardedOne

Hi,

rule 0 is a default rule in the XG which collects things like you are seeing and other ports that cannot find a matching rule. In theory you can ignore them unless they make a large percentage of your bandwidth.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v20.0.2 MR-2

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to rfcat_vk

More likely this is caused by Invalid Traffic blocking.

https://community.sophos.com/kb/en-us/131754

Adjust the timeout and you should see less blocks.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 TheBeardedOne over 5 years ago in reply to LuCar Toni

Thank you both for getting back to me.

So that probably explains the constant invalid traffic entries. I'll experiment with altering the timeout to see if it reduces the number of entries in the log.

All in all the Sophos XG VM is generating no more than approx 50Kbps of traffic per 2 hours which is insignificant. The issue is the saturated logs.

As for why XG is constanlty querying Google domains, any ideas?

Cheers
Cancel
Vote Up 0 Vote Down

Cancel
+1 MasterRoshi over 5 years ago in reply to TheBeardedOne

These are preconfigured fqdn hosts for Chromebook SSO. It will periodically do a lookup for them to populate the right IP addresses.
Cancel
Vote Up 0 Vote Down

Cancel
0 TheBeardedOne over 5 years ago in reply to MasterRoshi

Thanks MasterRoshi,

Is there anyway to prevent it?
Cancel
Vote Up 0 Vote Down

Cancel
+2 MasterRoshi over 5 years ago in reply to TheBeardedOne

Deleting the fqdn host objects in Host and Services -> FQDN hosts will do the trick.
Cancel
Vote Up 0 Vote Down

Cancel
0 TheBeardedOne over 5 years ago in reply to MasterRoshi

Legendary! Didn't even know that was there...

Something to play aorund with.

Thanks again Roshi!
Cancel
Vote Up 0 Vote Down

Cancel
0 SBE over 4 years ago in reply to MasterRoshi

MasterRoshi said:
Deleting the fqdn host objects in Host and Services -> FQDN hosts will do the trick.

Hi, I have a XG Firewall home with 3 APX320 WiFi AP's, one for each floor of my home.

I have that exact same problem than "TheBeardedOne". I see in my pi-hole query list that every five minutes, my 3 APX320 query www.google.com within the same minute. I tried turning all WiFi devices off, so that none could be the source of the queries. I also tried deleting every single google FQDN host in the list. Unfortunately my APX320 access points still query "www.google.com" every 5 minutes.

I cannot figure out what's the exact source of these queries.

Any idea ?

Many thanks to the community!
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 4 years ago in reply to SBE

Hi,

if you review logviewer firewall log you should see the source and destination of your traffic. What DNS are you using on the XG andd your clients?

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v20.0.2 MR-2

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel