Sophos Firewall: v20.0 GA: Feedback and experiences

Version 20 has a default allow firewall rule that allows all traffic even before filtering rules are set up.

Why?

Why would a firewall whose sole purpose is to protect a network from botnet/command and control activity, unauthorized application/web usage allow all outgoing activity on first install?

Version 19 had no such default allow rule, and the firewall administrator had to create an outgoing rule after configuring application/IPS/web filtering, ect.

Also the default TLS inspection rule stays on top of all other user-created rules, and allows "maximum compatibility". Why is it so many sites do not function when the TLS inspection rules are set to "block insecure SSL"? I have noticed that many banking/financial institutions do not function when block insecure SSL rules are used. Is there some deeper part to the story here about why secure SSL seems to be so hard to implement???

Version 20 has a default allow firewall rule that allows all traffic even before filtering rules are set up.

Why?

Why would a firewall whose sole purpose is to protect a network from botnet/command and control activity, unauthorized application/web usage allow all outgoing activity on first install?

Version 19 had no such default allow rule, and the firewall administrator had to create an outgoing rule after configuring application/IPS/web filtering, ect.

Also the default TLS inspection rule stays on top of all other user-created rules, and allows "maximum compatibility". Why is it so many sites do not function when the TLS inspection rules are set to "block insecure SSL"? I have noticed that many banking/financial institutions do not function when block insecure SSL rules are used. Is there some deeper part to the story here about why secure SSL seems to be so hard to implement???

Do you mean during a restart or at first installation. I have noticed in past versions that some of my devices access the internet after an XG restart until the configuration is fully loaded. WAN access should be disabled after restart until the configuration is loaded.

I disabled the default SSL/TLS rule and cloned it so I could move it around the SSL/TLS processing order. The exception list is very  long and makes you winder why you even try to use it and doesn't inspect UDP traffic yet?

Ian

SSL is TCP anyway, and it's good to block UDP on port 443 (QUIC)

It does not block it, it allows UDP through unchecked. Recently FB appears to have started using QUIC for the application.

Ian

Instead of clicking "Block QUIC" in the firewall rule, If you create a firewall rule at the top to block incoming/outgoing UDP on port 443, you mean it does not block it?

Can you explain - what your concerns are here? 
So if you are setting up the firewall, in a "pre registrations state" the firewall allows everything to the internet. That is to allow an administrator to setup the firewall and still have access to tools like a password safe etc. But this state should not be the usual case of a firewall. 

And there should be no difference between V20 and V19.5. It has the same behavior pre registration. 

The Default TLS inspection rule is setup to "No do anything" for the domains, you add to the list and are added by Sophos to the list. If you do not create a own list, it will not do anything. 

About TLS Inspection: There are two different modules working here: 1. Inspection by decryption & 2. blocking of ciphers / methods you dont want to have. They can work independently. So you can block for example RC4 but not decrypt the traffic. 

And if you find a website not working with blocking of insecure cipher, you can build an exclusion. But that is nothing, SFOS "related". 

Interesting, but strange answer.

A post from another forum I visit advises that ASUS router/firewall and PFSense also have the same startup issue with open internet access for a few seconds.

Ian