This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

v18: Bug with data counting in firewall rules?

Hi,

I am noticing a strange behavior in v18 and the data counting in the firewall rules. I have some incoming rules (from Internet to DMZ) that are coupled with corresponding DNAT rules. The DMZ contains webservers, so they send a lot more data than they receive. However, the counters in the rules are the other way around: They show a lot more incoming data than outgoing data.

Unless I am completely misinterpreting these counters (which I would like to rule out), it appears to me these counters have been reversed, e.g. incoming is actually showing outgoing, and outgoing is showing incoming.

Any thoughts?

This thread was automatically locked due to age.

Parents

0 FormerMember over 4 years ago

Hi cryptochrome,

Could you please share the screenshot of the firewall rule that shows data in and out counters? I will verify if it should be like that or not and update you.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 cryptochrome over 4 years ago in reply to FormerMember

Hi cryptochrome,

Could you please share the screenshot of the firewall rule that shows data in and out counters? I will verify if it should be like that or not and update you.

Thanks,

Sure, here you go:

Firewall Rule:

Corresponding NAT rule:

Firewall Rule Details:

Note that this is just one example. I am seeing the same "reversed" counter on other incoming rules.

How do you count the data? If someone on the internet initiates the connection and transfers a lot of data, does that count as incoming or outgoing?
Cancel
Vote Up 0 Vote Down

Cancel
0 Prism over 4 years ago in reply to LuCar Toni

Well, I completely forgot about this.

Will be checking it out right now.

Thanks!

If a post solves your question use the 'Verify Answer' button.

Ryzen 5600U + I226-V (KVM) v21 EAP @ Home

Sophos ZTNA (KVM) @ Home
Cancel
Vote Up 0 Vote Down

Cancel
0 cryptochrome over 4 years ago in reply to LuCar Toni

That looks interesting. Does this require additional licensing? Or is it part of the XG license?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to cryptochrome

https://www.sophos.com/en-us/medialibrary/PDFs/partners/whats-in-the-central-firewall-reporting-eap.pdf

Licensing Collecting, storing, and aggregating firewall logs naturally requires compute and storage resources in the data platform. For the EAP, we are providing administrators with a rolling seven days of log retention and reporting data per firewall, at no cost. Additional details will be made available later regarding the licensing options for CFR, which will include both free and premium licensed capabilities.

As mentioned, they are waiting for Feedback about their new product in Central (Called CFR).

There are some more option for reporting.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 4 years ago in reply to LuCar Toni

I am using CFR and it does not add useful reporting at all. Sorry Luca but XG reporting is very bad. Please consider me to improve the reporting. Reporting and logging have the same problem: understand what is happening is very time consuming! Utm 9 has better reporting far away. I open privately for discussion.

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 Ryan Partington over 4 years ago in reply to lferrara

Hi Guys

I'm going to bookmark this thread so when I come to discuss the traffic counters with a customer I have some reference material to work through rather than using intuition. Thanks for all the helpful comments.

------------------------------------------------

worlds number one free ICMP monitoring platform: https://pinescore.com
Cancel
Vote Up 0 Vote Down

Cancel
0 FloSupport over 4 years ago in reply to LuCar Toni

Hi All,

Thank you for sharing your feedback regarding this topic. I'll forward these over to the Product Team for their consideration.

Thanks LuCar Toni for your explanation and recommendations.

Florentino
Director, Global Community & Digital Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question, please use the 'Verify Answer' button.

The Award-winning Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 Clara Tarris over 4 years ago in reply to cryptochrome

how to unblocked inbound connection that do not matched? pls help me.. thank you
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 4 years ago in reply to Clara Tarris

Please start a new thread on this subject as it is not related to this thread.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 4 years ago in reply to cryptochrome

Reporting and Logging shall have higher priorities now.

XG v18 has the features to be used in production environment (Kudos to all Sophos team) but now it is time to discuss and improve/redesign logging and reporting).

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 4 years ago in reply to lferrara

FloSupport

can we have an update in this topic?

I really aware of this issue as reporting is one way to really understand what is going on specially now that with CoronaVirus, attacks are increasing and traffic must be properly logged and observed.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 lferrara over 4 years ago in reply to lferrara

FloSupport

can we have an update in this topic?

I really aware of this issue as reporting is one way to really understand what is going on specially now that with CoronaVirus, attacks are increasing and traffic must be properly logged and observed.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data