my network exposed

Hi Feras,

Thank you for reaching out to Sophos Community.

I would recommend reviewing your Firewall rules and ensuring you have properly placed a blocking rule or kindly check if there are any Allow any rules that are causing any external access inside your network.

You may also check the Log viewer to troubleshoot the issue.

For best practice, kindly see the following KB

• Sophos Firewall: Best practices

hello,

thank you for your reply, i have chose http/https protocol only and when i test my policy still i can see both sides, can you tell me what protocol is used in scanners?

regards

Hello,

can you show as a little diagram to understand from where you are scanning when say you "plug it side by side with sophos" ?

And what exactly do you mean by using "a large range" ?

Can you show us a sreenshot of your scanning results?

Hi,

I would suspect that you have an any zone, any source network, any destination zone etc firewall rule?

Ian

hello,

thank you for your reply, side by side means on the same switch with sophos as i have a range of public IPs i made a scan from outside my network including my network range and it showed my my PCs, names, mac address.

large range means i took a sample to scan from 192.168.0.0 to 192.168.250.250 just and actually my network is 192.168.8.*

i found our one rule was causing that issue but i couldnt figure out what protocol ip scanner use.

regards

hello,

thank you for your reply, side by side means on the same switch with sophos as i have a range of public IPs i made a scan from outside my network including my network range and it showed my my PCs, names, mac address.

large range means i took a sample to scan from 192.168.0.0 to 192.168.250.250 just and actually my network is 192.168.8.*

i found our one rule was causing that issue but i couldnt figure out what protocol ip scanner use.

regards

Hi,

Are you referring to the following?

Given a range of IP addresses to scan, the network IP scanner conducts a sequential scan on each of the IPs using Internet Control Message Protocol (ICMP) ping sweeps or Simple Network Management Protocol (SNMP) scans to discover the network entities within the given constraints. Address Resolution Protocol (ARP) tables can also be used by the scanner for conducting neighbor scans or device rediscovery.

blogs.manageengine.com/.../the-what-why-and-how-of-using-network-ip-scanners-in-ip-centric-it-infrastructures.html