XGS136 is blocking STAS traffic

Question

Hi everyone, I have some problems with the STAS service. The picture shows the topology:

I have two locations, the HQ with an XG210, and the branch with XGS136. Both are connected through a VPN tunnel. The STAS server is in HQ location. The communication between STAS and main XG210 is OK. I copied the parameters from XG210 to XGS136: in AUTHENTICATION > STAS, I permit the connection in ADMINISTRATION > DEVICE ACCESS. 
 STAS point to the XGS136's LAN IP address (not the VPN end tunnel). Traffic between locations it&acute;s ok. The STAS server is the AD and DNS server for the branch, and work all OK. I can see, in XGS logs, that traffic from STAS to LAN IP address is blocked

Any ideas about where can I investigate? thanks a lot

Vivek Jagad · Accepted Answer

Hi Daniel Zulian , Thank you for reaching out to the community, ensure the following communication is allowed: 
 The Active Directory server should have the following ports open: 
 
 STA Collector > XG Firewall (UDP 6060) 
 XG Firewall > STA Collector (UDP 6677) 
 STA Agent > STA Collector (TCP 5566) 
 
 You only need to enable the following ports if you use these methods: 
 Workstation Polling Method (WMI) or Registry Read Access : 
 
 Starting from TCP 135 
 Starting from TCP 445 
 
 Logoff Detection Ping : 
 
 Outgoing ICMP 
 
 STAS Collector Test : 
 
 Incoming/Outgoing UDP 50001 
 
 STAS Configuration Sync : 
 
 Incoming/Outgoing TCP 27015 
 
 Note: RPC, RPC locator, DCOM and WMI services should also be enabled on the clients for WMI/Registry Read Access. Additionally, you can refer the recommended read below: 1.) Sophos Firewall: Best practice for STAS 2.) Sophos Firewall: Troubleshoot WMI connectivity issue with Sophos STAS