This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unable to Clone a WAF rule in XG 18.5-MR2

Robert Hau over 2 years ago

If you try to clone a WAF rule in your XG 18.5-MR1.

They don't work.

I was scratching my head getting a forbidden message after cloning an existing WAF rule.

Destroyed it and recreated and it works.

This thread was automatically locked due to age.

0 emmosophos over 2 years ago

Hello Robert,

Thank you for contacting the Sophos Community.

Was this the error you were getting?

If so, is because you need to change the listening port or the domain protected by the WAF rule

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Robert Hau over 2 years ago

So i had a simple WAF rule that was listening on xxxx.xyz.com

I cloned it to blah.xyz.com and the xxxx.xyz.com was working just fine.

blah.xyz.com just kept giving me forbidden.

I have created these dozens of times in the past.

Re-created it manually exactly the same way, and it worked.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 2 years ago in reply to Robert Hau

Hello Robert,

Thank you for the follow up.

If you could replicate, and send me the steps I could double check, but basically what I did was:

1. Clone the WAF rule

2. Try to save, got the error

3. Change Port

4. Saved

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Robert Hau over 2 years ago in reply to emmosophos

Build out a WAF firewall for a https:// site.

Confirm it works.

Clone that rule and change the https:// url and the webserver.

It saves fine but won't function.

All requests fail in a "Forbidden" As if you didn't have it configured.
Cancel
Vote Up 0 Vote Down

Cancel