Sophos Firewall: v20.0 MR2: Feedback and experiences

Hi,

when will Sophos fix two small but impactful bugs?

1. if you use auto created firewall rules (I know better not to use) the logging is always off!

2. the same with the dop all rule - NO logging

Both would be easy to fix and would make troubleshooting much easier!

BR Gerd

Essentially they are not considered as bugs. Auto created firewall are not using logging per default. 

The default firewall rule is not existent. It is a visual placement, to indicate what happened if there is no matching firewall rule. If you want to have logging for default drop, you can create your own firewall rule at the bottom.

As far as I remember, auto created firewall rules did not use logging on UTM either. It’s a design choice. As well as default drop. You could enable it, if you want, like you can create your own default drop firewall rule on SFOS. 

Why do you consider those system designs as bugs ? 

As a longtime Checkpoint customer I can say that no logging for dropped packets used to be the default for Checkpoint as well. However, over time, they changed that behavior to include dropped packets in the logs. Personally, I think it is a good thing because you may have something sitting on your network doing some crazy things that you would not easily pick up on. As a default I think having logs for drops makes sense for new installations. Let the admins turn off the noise if they don't like it. Just my opinion.

As a longtime Checkpoint customer I can say that no logging for dropped packets used to be the default for Checkpoint as well. However, over time, they changed that behavior to include dropped packets in the logs. Personally, I think it is a good thing because you may have something sitting on your network doing some crazy things that you would not easily pick up on. As a default I think having logs for drops makes sense for new installations. Let the admins turn off the noise if they don't like it. Just my opinion.

I agree :-)

I agee.
Let's call it a design flaw if Luca doesn't like the term bug in this context ;-)

It's clearly a design decision and not unique to Sophos. Add Cisco to the list of 'default drop with no log'.

I can see why people may want it both ways so there is no 'right' default. However, if you are struggling to review and modify the default rules on a firewall when you set it up, you should clearly be doing something else.

As you so clever said:

”there is no 'right' default”

Hello JasP,
With all due respect!
But we should keep a good tone here!

Have you ever tried to edit a Sophos drop all rule?

Then you would know that your contribution is not only superfluous, but unfortunately also completely wrong!

Greetings Gerd

Gerd Rehders1 said:

Have you ever tried to edit a Sophos drop all rule?

Then you would know that your contribution is not only superfluous, but unfortunately also completely wrong!

I worded it badly because, of course, you can't edit the default drop rule. You just add one above it with logging turned on. This should be something that anybody who wants to work on firewall rules should be able to work out.

I meant your sentence "Maybe you should do something else instead!"

That's simply not appropriate in a forum like this!


I'm responsible for >170 firewalls and am a Sophos architect, perhaps I should add that to my signature.
And small design decisions like that often cost a lot of time.

So back to the factual discussion, ok?

This is called feedback and experiences - Not tell anyone how to do it better!!!!!

And at the end of the day, you didn't actually give me any really important technical tips!

Based on the different personas, you can argue of both situations. 

As mentioned earlier: The "default drop rule" is an cosmetic item to showcase what happen, if there is no firewall rule. If you need logging, you need your own firewall rule. 

For Partners/power users of SFOS, it would be also useful to think about XML Import/Export and/or Backup/Restore scenarios, to reduce the amount of configuration needed per firewall.

This thread is also to reflect the particular Release. Discussing something, which is documented in this thread is maybe not the best solution, as it will blow up this thread and people looking for MR2 feedback have to read more feedback about SFOS since V18.0.