Logging in Sophos XGS

Hello,

Thank you for contacting Sophos Community.

This might help you to idenitfy:

https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/138132/sophos-firewall-how-to-troubleshoot-dropped-packets#:~:text=In%20Sophos%20Firewall%20web%20admin,and%20turn%20on%20Packet%20capture.

Also, you can collect the drop packet capture in CLI to identify the destination server IP or Port.

support.sophos.com/.../KB-000036858

Thank you for your quick response. I already checked this links. If I activate the protocol in the rule I can see all packets matching the rule. Means the positive outgoing packets. Why can't I just see the dropped packets like in Sophos UTM? I use the filter source IP and can only see the allowed packets? But I don't need this information.

Let me give you an example. I only need to reach site 1.microsoft.com. It's located in Netherlands. If I add the Netherlands as target network, it works. But If I add the FQDN 1.microsoft.com it doesn't work. And we never find out why, cause we see nothing blocked in the protocol...........

SFOS (like UTM) uses a Packet Filter. Both work the same way: But SFOS does not have a default drop logging. You can build this yourself, if you need it: https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/FirewallRules/FirewallRulesLogDroppedTraffic/index.html 

Then you see packets dropped by the firewall, because no firewall applied. 

Thank you, the problem still exists but now we can see the blocked packets and are one step further. So your answer solves our problem with the protocol.