Wildcard FQDN Stopped Working After Upgrade

Hi CV_Sophos ,

Are you using FQDN on Firewall rules?

If yes, suspect this is related to NC-136442 - Where wildcard does not work in fw rules

I may recommend you open a support case to have this further investigated.

Kindly share with us caseID once you have it. 

Thank you for your patience and thank you for choosing Sophos. 

Regards,

Hello Raphael,

The opened case # is 01875268.

Thank you,

James

Hello James,

Thanks for taking the time to share the caseID.

We shall track the progress of your case. 

Thank you for your patience and thank you for choosing Sophos. 

Regards,

I believe I have found the issue. Under previous support recommendations I was advised that each rule should have its own dedicated/linked NAT configured. So, a large portion of our "dedicated" rules have a linked NAT configured. This appears to be working fine until there are two rules that apply to a wildcard FQDN as the destination that also contains the same host in both sources. For instance, in this case our ADSync server was a source for two rules (one for actual AD Sync - let's call it rule #1 - and another for Entra App Sync - let's call it rule #2) and both rules required a wildcard destination of *.msappproxy.net. After heavily monitoring the log files I was able to see that a request would be sent with rule #1, received, and then responded/translated to using rule #2 and vice versa. This was ultimately leading to the packets being dropped because they were not associated with a request/connection. Once I disabled rule #2 and gave the firewall 24 hours to, hopefully, clear all active sessions, the rules are working as they did with the prior firmware (19.5.4). Other similar situations have happened before when working with rules that have a linked NAT rule. To clarify, these are all LAN to WAN firewall rules. No other zone to zone type has a linked NAT. I'm not really sure why the prior firmware was behaving differently. Maybe it was more associated with the appliance restart that reset all the connections. Regardless, the issue is now resolved (ticket closed) and I will be cleaning up firewall rules and the linked NAT configurations.

Thank you,

James

Hello James,

Thank you for taking the time to update the thread. We're glad the issue has now been resolved. 

Thank you for your time and patience and thank you for choosing Sophos.

Regards,