This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG constantly querying Google domains, why?

Hi all,

First post here, hopefully I can be a contributing member of the communty. For now I have a question for you guys.

I'm slowly getting round to setting up Sophos XG Home to replace my router. It's currently connected to my home network via it's WAN port, with the LAN port creating a new network on the backend for testing. The WAN link is assigned an IP address etc via DHCP from the current router. I have recently setup Pi-Hole with Unbound which is handling all DNS queries on the primary LAN.

The question is as described in the subject. Why is Sophos XG constantly querying Google domains? I have made sure there is nothing else on the LAN side of the Sophos VM.

Call me paranoid, but i dont like the idea of anything on my network having constant communication with Google, or anything else for that matter, certainly without me knowing.

Does anyone have any ideas why it's happening, and whether I can stop it?

TIA

TheBeardedOne

This thread was automatically locked due to age.

Parents

0 TheBeardedOne over 5 years ago

I'm also seeing the below in the Sophos logs... Seems to coincide. Could XG be trying to use Google to do a look up for the IP's trying to connect? I can't imagine that being the case but it's all i can comeup with for now.

I've checked each IP listed and they're all linked to Cyren Inc/Commtouch.
Cancel
Vote Up 0 Vote Down

Cancel
0 TheBeardedOne over 5 years ago in reply to TheBeardedOne

Found another discussion regarding Commtouch\Cyren...

https://community.sophos.com/products/xg-firewall/f/logging-and-reporting/101128/commtouch-ip-addresses-being-blocked-by-xg

There doesn't seem to be a conclusion or fix however.

If anyone can explain any of this it'd be greatly appreciated.

Best regards

TheBeardedOne

EDIT: These two issues aren't linked. After changing the DNS server on the Sophos to Google DNS the logs on the Pi-Hole stopped coming through, but the logs on the Sophos relating to Commtouch\Cyren continue to come through thick and fast.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 5 years ago in reply to TheBeardedOne

Hi,

rule 0 is a default rule in the XG which collects things like you are seeing and other ports that cannot find a matching rule. In theory you can ignore them unless they make a large percentage of your bandwidth.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v20.0.2 MR-2

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to rfcat_vk

More likely this is caused by Invalid Traffic blocking.

https://community.sophos.com/kb/en-us/131754

Adjust the timeout and you should see less blocks.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 TheBeardedOne over 5 years ago in reply to LuCar Toni

Thank you both for getting back to me.

So that probably explains the constant invalid traffic entries. I'll experiment with altering the timeout to see if it reduces the number of entries in the log.

All in all the Sophos XG VM is generating no more than approx 50Kbps of traffic per 2 hours which is insignificant. The issue is the saturated logs.

As for why XG is constanlty querying Google domains, any ideas?

Cheers
Cancel
Vote Up 0 Vote Down

Cancel
+1 MasterRoshi over 5 years ago in reply to TheBeardedOne

These are preconfigured fqdn hosts for Chromebook SSO. It will periodically do a lookup for them to populate the right IP addresses.
Cancel
Vote Up 0 Vote Down

Cancel
0 TheBeardedOne over 5 years ago in reply to MasterRoshi

Thanks MasterRoshi,

Is there anyway to prevent it?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 TheBeardedOne over 5 years ago in reply to MasterRoshi

Thanks MasterRoshi,

Is there anyway to prevent it?
Cancel
Vote Up 0 Vote Down

Cancel

Children

+2 MasterRoshi over 5 years ago in reply to TheBeardedOne

Deleting the fqdn host objects in Host and Services -> FQDN hosts will do the trick.
Cancel
Vote Up 0 Vote Down

Cancel
0 TheBeardedOne over 5 years ago in reply to MasterRoshi

Legendary! Didn't even know that was there...

Something to play aorund with.

Thanks again Roshi!
Cancel
Vote Up 0 Vote Down

Cancel
0 SBE over 4 years ago in reply to MasterRoshi

MasterRoshi said:
Deleting the fqdn host objects in Host and Services -> FQDN hosts will do the trick.

Hi, I have a XG Firewall home with 3 APX320 WiFi AP's, one for each floor of my home.

I have that exact same problem than "TheBeardedOne". I see in my pi-hole query list that every five minutes, my 3 APX320 query www.google.com within the same minute. I tried turning all WiFi devices off, so that none could be the source of the queries. I also tried deleting every single google FQDN host in the list. Unfortunately my APX320 access points still query "www.google.com" every 5 minutes.

I cannot figure out what's the exact source of these queries.

Any idea ?

Many thanks to the community!
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 4 years ago in reply to SBE

Hi,

if you review logviewer firewall log you should see the source and destination of your traffic. What DNS are you using on the XG andd your clients?

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v20.0.2 MR-2

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 SBE over 4 years ago in reply to rfcat_vk

Hi, the DNS for my XG is set to the pi-hole located on the same LAN. The pi-hole is DHCP server for all my LAN clients (to get hostnames in my pi-hole logs) also with the DNS set to the pi-hole.

I gave a look at my firewall log and noticed a strange behavior. My APX320 AP's (connected to LAN network) generate denied traffic to the LAN IP of the firewall to port 417 ?? The AP's are connected on the same LAN then the Firewall , so that should not happen, should it !

Many Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 4 years ago in reply to SBE

Hi,

what are IP addresses of your external DNS?

What does the rule that is causing the traffic drop look like? Were your APX ever registered with Sophos wireless central?

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v20.0.2 MR-2

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 SBE over 4 years ago in reply to rfcat_vk

Yes sorry, I forgot to mention that the external DNS set on my pi-hole, is openDNS.

The rule is "0" and mentions "appliance access" "denied" on LAN port from APX320 IP, src port 42523 to XG IP, dst port 417 UDP.

No, I don't use Sophos wireless central as I'm a home user. The AP's are registered on the XG.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 4 years ago in reply to SBE

Hi,

rule 0 is the default rule when the traffic cannot find a matching rule and is dropped.

I checked UDP 417 and the answer was not clear to me. I would check the configuration of the APX in the XG.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v20.0.2 MR-2

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 SBE over 4 years ago in reply to rfcat_vk

Hi,

I checked configuration of my APX320. Nothing weired. I also gave another look at my logs. Still these strange invalid traffic / denied access from my APs to the XG...

Nevertheless I noticed in my pi-hole logs, that my 3 APX320 (the P5200... devices) are doing the same amount of requests (656 in the screenshot) to Google every 5 minutes ! And it's not a device connected to them but the 3 APX320 itself !
Cancel
Vote Up 0 Vote Down

Cancel