openSUSE update triggers IPS false positive

Did you try to stop the ips service?

Which XG version are you running?

Thanks

Hi Luk thanks for your reply.

I only just realized I had neglected to add the version of XG I'm running, I apologize for the oversight. It's version SFOS 17.5.9 MR-9. I believe that I did try halting the IPS service during a previous troubleshooting attempt of this issue but I haven't done so again since applying the most recent stable firmware version. This was an issue I had with the previous firmware as well.

Thanks again for your help. 

Hi  

If stopping the IPS service or removing the IPS policy from the rule fixes the issue, then I would suggest you open up a support case.

This will need to go to the Sophos signatures team to review the traffic recorded in the packet capture and reproduce it on their end.

If you are paid for user then its easy to open a support case.  If you are a home based user, then the best you can do right now is to create a source IP rule without IPS enabled on it.

So please try with IPS off either globally (ie stopping the service completely) or with IPS removed from the rule and let us know how it goes.

Thanks!

Hi  

If stopping the IPS service or removing the IPS policy from the rule fixes the issue, then I would suggest you open up a support case.

This will need to go to the Sophos signatures team to review the traffic recorded in the packet capture and reproduce it on their end.

If you are paid for user then its easy to open a support case.  If you are a home based user, then the best you can do right now is to create a source IP rule without IPS enabled on it.

So please try with IPS off either globally (ie stopping the service completely) or with IPS removed from the rule and let us know how it goes.

Thanks!

Hi KingChris, Thanks for joining in and offering your advice. I appreciate it. 

Sadly, I am a home user so I won't be able to push the issue higher in the chain. Stopping IPS service globally does allow my openSUSE clients to successfully update with out issue. I do believe that it is a signature related problem triggering a false positive. 

Adding a source IP based rule less IPS over a destination domain based one would work for sure and would be the most reliable solution, though it would be a shame to loose the added protection that it affords for the regular traffic. 

Due to the way that the openSUSE update chain works, I know adding just the re-director server domain to a rule with IPS disabled is ineffective as the updates themselves will come from one of the many mirrors. That causes the traffic to go through my IPS enabled general rule (the next available rule where the mirror traffic can get though) where it ultimately fails. 

Adding the mirrors as well to the update rule without IPS appears effective and allows IPS to remain enabled for all other non update related traffic from those systems at this moment, although it's a very inelegant solution with the number of USA mirrors and ultimately could break at any time. 

Just for the reference of anyone who might be reading this and wish to do so, like most Linux based distros it's possible to have openSUSE query and update from one or more specific mirrors, but it's not desirable as those mirrors could have issues or be very slow causing update problems. Even though it would simplify XG firewall rule creation, it's probably best to avoid doing so and allow openSUSE to have it's default pick of update mirrors.

The issue is quite easy to reproduce though should a member of the Sophos XG team find themselves with available time to do so. Running even a live version of openSUSE and attempting to update in terminal via Zypper should result in the problem. Updating at all will show the failures logged in XG but running update in terminal yields some quick, helpful troubleshooting info on the client side.

I do wish I could be of more help with this, though I do understand that Sophos's attention must be focused on its subscription based customers. Hopefully other users of openSUSE may benefit though from this rather rudimentary workaround.  

Thanks to you and Luk for your timely help with this issue.