This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG Firewall is impersonating the whole subnet for port 25

Good day,

Currently we are doing network discovery, and we found that the whole subnet are answering to the ping discovery which is weird. Upon checking, the ip addresses that are not assigned are replying via port tcp 25. When we telnet it the "220 sophos esmtp ready" was reflected. Is this normal behavior?

This thread was automatically locked due to age.

Top Replies

Vivek Jagad 10 months ago +3 verified

Hello John Felix Rodrin , Thank you for reaching out to the community, yes it is.

+1 Vivek Jagad 10 months ago

Hello John Felix Rodrin ,

Thank you for reaching out to the community, yes it is.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +3 Vote Down

Cancel
0 John Felix Rodrin 10 months ago in reply to Vivek Jagad

Good day Vivek Jagad ,

Thanks for your immediate response. As it is a normal behavior, is this due to a feature or something? If you can share me a document or short explanation why is sophos capable of doing this as I need to discuss this with my boss. Unfortunately, there was no proper transition from the previous network administrator as such i'm currently studying the environment at my work. Thank you once again
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad 10 months ago in reply to John Felix Rodrin

Unfortunately, we do not have any documentation on this to provide you.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni 10 months ago

Could you do a Packet Capture on the firewall and check, how the firewall response to this?

Check for the firewall rule. Do you use the SMTP MTA? Do you have the firewall rule in place for ANY to ANY Scan SMTP?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel