This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Blocking apps allows to block one of FQDN Host Group but not other

I have two FQDN hosts : Instagram (*.instagram.com) and Facebook (*.facebook.com). These two FQDN hosts are added in an FQDN host group named Social Media.

A rule in "Traffic to WAN" is configured for LAN to WAN that rejects this specific FQDN Host group. while testing this rule policy tester shows the packets being rejected as expected. When I test it in the client system, only the instagram.com is blocked. Can't seem to figure out why?

This thread was automatically locked due to age.

Top Replies

Vivek Jagad 8 months ago +1 suggested

Hey New Temp , Thank you for reaching out to the community, may I ask the purpose of blocking this domains via FQDN, where as you can block this by creating a custom category .

Parents

0 Vivek Jagad 8 months ago

Hey New Temp ,

Thank you for reaching out to the community, may I ask the purpose of blocking this domains via FQDN, where as you can block this by creating a custom category.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel
0 New Temp 8 months ago in reply to Vivek Jagad

Yes but it is for educational purpose. Why a rule on top stating to reject packets for a specific domain name won't block the packets? I am unable to wrap my head around this. I'll take a look at that custom group you suggest but I need to know the reason for this behavior.
Cancel
Vote Up 0 Vote Down

Cancel
0 Bharat J 7 months ago in reply to New Temp

Hi New Temp ,

Reject action Drops traffic and sends an ICMP port unreachable message to the source for UDP and ICMP traffic. For TCP traffic, a TCP reset message is sent to the source.

Check Log Viewer for more information.

Regards

"Sophos Partner: Networkkings Pvt Ltd".

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Bharat J 7 months ago in reply to New Temp

Hi New Temp ,

Reject action Drops traffic and sends an ICMP port unreachable message to the source for UDP and ICMP traffic. For TCP traffic, a TCP reset message is sent to the source.

Check Log Viewer for more information.

Regards

"Sophos Partner: Networkkings Pvt Ltd".

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data