This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XGS136 WAF no function after migrate from XG135

hello,

today we migrate from an old XG135 to a new XGS136. actually we wait for our license from sophos that we ordered. So we activate the 30-day evaluation on Sophos.com:

Before the migration we have 3 web server with waf online and that works fine. Now, after migrate the web server are not reachable from the internet. In the log are no entries...

Have anyone a idea? is the evaluation license the problem? is the migration the problem?

Thanks for any idea!

This thread was automatically locked due to age.

0 LuCar Toni over 2 years ago

Did you purchase two appliances for HA? Likely the license is on the other appliance. Then use a License transfer: https://support.sophos.com/support/s/article/KB-000036692?language=en_US

Trial licenses should grant full access to the features. If you do not see any kind of log entries, it looks like the WAF Rule is not getting hit. Did you 1:1 replace the appliance?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 chrrut over 2 years ago in reply to LuCar Toni

I bought only one appliances.

We replace a old XG135 with a new one XGS136, we use the backup from XG135 on the XGS136.

the configuration - Webserver:

configuration firewall:
Cancel
Vote Up 0 Vote Down

Cancel
0 chrrut over 2 years ago in reply to chrrut

and here a screenshot from the license in the XGS web interface:
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 2 years ago in reply to chrrut

Try to perform a packet capture on the diagnostic for port 443. Do you see traffic hitting your WAN IP?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 chrrut over 2 years ago in reply to LuCar Toni

I See this traffic:
Cancel
Vote Up 0 Vote Down

Cancel
0 chrrut over 2 years ago in reply to chrrut

here a screenshot from the firewall rules, there a no traffic at the counter from the rules
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 2 years ago in reply to chrrut

Is the certificate maybe broken? Which certificate do you use?

Could you check certificate / CAs, if there are some special characters?

Then check the pattern of the Signatures (Sophos and Avira).

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 chrrut over 2 years ago in reply to LuCar Toni

We use a Certificate from SSLTrust, it looks good, no special characters.

The pattern are the newest now:
Cancel
Vote Up 0 Vote Down

Cancel
0 chrrut over 2 years ago in reply to chrrut

at firewall rules the WAF rules are marked as "unused", maybe is there a problem?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 2 years ago in reply to chrrut

Basically this means, there is no traffic reaching those Rules. (See 0 Bytes in/out).

Can you show us your network interfaces?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel