Sophos Firewall v22 EAP is now available! Click here to learn more.

Thread Info
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Tracing problems in XG

DAENG

This is actually a very generall question. I often spend hours to trace a problem within the Firewall Rules and Policies, if there is blocking rule then I am actually able to find it fast in the log viewer.

But if there is no rule then I mostly go trough endless trial an error sessions.

For example I have a camera which was on port 86 with HTTP only. So I switched it for a new one which has HTTPS, so I changed the port from 443 to 440.

I opened the port in my DSL Router just as the other so I am pretty sure it comes in. But chaning it in the Firewall and NAT rules did not help.

So my question is how would I trace this problem?



This thread was automatically locked due to age.
  • 0

    Why are you opening a port on your router?
    your change will not go out the firewall rule with https.

    ian

    XGS118 - v22.0 EAP

    XG115 converted to software licence v21.5.0

    If a post solves your question please use the 'Verify Answer' button.

    • 0 in reply to rfcat_vk

      I want to see the Kamera from outside, so I opned port 440 on the DSL Router which goes to the DMZ where the cameras are in.

      • 0 in reply to DAENG

        Please provide a simple network diagram, your setup seems strange.

        XGS118 - v22.0 EAP

        XG115 converted to software licence v21.5.0

        If a post solves your question please use the 'Verify Answer' button.

        • FormerMember
          0 FormerMember in reply to DAENG

          Hi ,

          Thank you for reaching out to Sophos Community.

          Assuming you're able to access Camera internally on port 440 == https://<local_camera_IP>:440

          You can check the following things on XG to narrow down the reported issue.

          ==> Ensure that you've configured service with source port: 1:65535 and destination port:440

          ==> Login to SSH > 4. Device Console and run below command.

          console> tcpdump 'port 440

          and then try to access camera on puclic IP == https://<public_IP>:440

          ==> You may check drops with below command.

          console> drop-packet-capture 'port 440

          ==> If you're able to see un-replied packets on XG for destination port 440 then try to apply SNAT as 'MASQ' in the NAT rule.