Sophos Firewall: v18.5 MR1: Feedback and experiences

IPS/DOS is still broken. Something during v18.0.4 b broke IPS/DOS and has not been required in later releases.

I have tried multiple ideas on settings and the only setting that works is disabling IPS/DOS. One security camera will load without triggering IPS/DOS but when I try to load all 4, only one loads and the others either timeout or disconnect.

I have tried with the web proxy, DPI and neither no change to the ability to connect when IPS/DOS is enabled. The logviewer shows nothing in the IPS view but lots of either DOS on port 53 or broadcasts.

ian

Try a DOS exception for such devices, if you do not want to increase the numbers of the particular device. 

support.sophos.com/.../KB-000035751

Thank you.

I would expect the DOS bypass process to be a temporary fix until the DOS process is fixed.

i tried that in v18.0.5 586 and came to the conclusion that the bypass process does not work. You end up with a log of hundreds of valid connections to external DNS devices. The connections never actually complete to the security cameras.

I tried individual rules and network rules with the same result, no stable connections if the connection established. Also there are a large number of failed DHCP requests.

I do not see the same number of entries when I disable the DOS settings.

Also the DOS bypass process is a bit ancient, eg no dropdown lists to select networks or devices or even protocols (service).

Ian

Thank you.

I would expect the DOS bypass process to be a temporary fix until the DOS process is fixed.

i tried that in v18.0.5 586 and came to the conclusion that the bypass process does not work. You end up with a log of hundreds of valid connections to external DNS devices. The connections never actually complete to the security cameras.

I tried individual rules and network rules with the same result, no stable connections if the connection established. Also there are a large number of failed DHCP requests.

I do not see the same number of entries when I disable the DOS settings.

Also the DOS bypass process is a bit ancient, eg no dropdown lists to select networks or devices or even protocols (service).

Ian