FILT-APP Block Office365 SOPHOS XGS

Hi Mathieu Rojo ,

Thank you for reaching out to the community, you can log a service request with Sophos support, can help provide debug logs and analysis.

Alternatively, application blocked can be checked under the log viewer > Application filter...

You can also create a customer application filter, where you can allow certain apps or categories. 

Note: Application filter has a higher precedence compared to web, so ensure category allowed in web is not blocked in application filter. 

Hi Vivek,

In the APP-FILTER log viewer I don't have any information for this. It's a problem.

And I have already create my application filter based on filter "Generaly  unwanted Apps", but my problem it's I have a filter who block my setup and I can't find it in the log. 

This would have helped me find the category that is blocking.

I go create a ticket to the support. Thank you.

Great day,

Hello Mathieu Rojo ,

The predefined "Block generally unwanted apps" Application filter policy has 'File Transfer' apps being denied in it by default, including several MS apps, so likely this is the cause of why you're having issues. 

As Vivek suggested above, you can further check this under Log Viewer > Application Filter

If you still want to use this predefined application filter, you can configure a new application filter using this as a template, then fine-tune the application filter to meet your requirements without your legitimate traffic being denied. 

Hope this helps. Many thanks for your time and patience and thank you for choosing Sophos. 

Regards,

Hi Raphael,

I already configue a new application filter on this template.

I know the "File Transfer" category is the cause of my problem. But in this category we have a lot of items and I would like know which items block. I would like found in log but nothing.

I had to use this command in cli "service ips:debug -ds nosync" and I can find who the "Multi Thread File Transfer" item was the good.

Is it possible to exclude only one particular app ?  Or do I have to remove this item?

thank you

Hi Raphael,

I already configue a new application filter on this template.

I know the "File Transfer" category is the cause of my problem. But in this category we have a lot of items and I would like know which items block. I would like found in log but nothing.

I had to use this command in cli "service ips:debug -ds nosync" and I can find who the "Multi Thread File Transfer" item was the good.

Is it possible to exclude only one particular app ?  Or do I have to remove this item?

thank you

Hello Mathieu Rojo ,

Thanks for the additional details.

If you find the "Multi Thread File Transfer" is the legitimate traffic that's being blocked under "File Transfer Category" and you still want to block the category File Transfer, here's what I may recommend:

You may select the application individually,

Then set to - Allow

Then put this on top of the of your Application Filter list, then Configure a Select All for File Transfer then set it to deny

Then set it below your Allow rule on the application filter, so the arrangement would look like this: 

- You may also further add any applications you need to allow on top of your deny rules. 

- For your testing, I may recommend you test it on a Firewall Rule on Top using specific settings, e.g. test it on 1 host only before completely applying the application filter to the whole network.

- Further, denied applications on your rules can be seen under Log Viewer > Application Filter 

Hope this helps. Have a nice day and thank you for choosing Sophos.

Cheers,

Hi Raphael Alganes , Thank you.
This is the solution that works best for me. 

Thank you for taking the time and precision of your explanations.

Great day !

Hello Mathieu Rojo ,

You're welcome, Glad we're able to be of help. 

Have a nice day and thank you for choosing Sophos.

Cheers,