Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Replies 2 replies
  • Answers 1 answer
  • Subscribers 38 subscribers
  • Views 163 views
  • Users 0 members are here
Options
Suggested

Sophos XG blocking NTP

Travis Grenell

Sophos Firewall is blocking NTP communication. This is the same issues as described here:  LAN Clients unable to receive External NTP Server Time 

However I have added the firewall rule as the OP of that thread suggested and it has made no difference. Sophos XG has a WAN port and a LAN port. I can see on the WAN port the request go out and response come in. However on the LAN port, the Sophos XG does NOT forward the packet to the client; on the LAN port we only see the request.

Here's screenshots of the rule, wireshark captures, and tcp dump commands used on Sophos XG menu option 5 then 3 for Advanced shell.

NTP command run on linux system:
 ntpdate -buvvv 132.163.96.2
26 Dec 17:05:24 ntpdate[4829]: ntpdate 4.2.6p5@1.2349-o Tue Jun 23 15:38:19 UTC 2020 (1)
26 Dec 17:05:32 ntpdate[4829]: no server suitable for synchronization found



removed image showing public ip
[edited by: Travis Grenell at 10:51 PM (GMT -8) on 26 Dec 2024]
Parents
  • 0

    The Wireshark captures used these commands, and I confirmed Port3 is my LAN and Port2 is my WAN:

    LAN: tcpdump -i Port3 -n host 192.168.7.2 or host 132.163.96.2 -w /tmp/lanport.pcap

    WAN:  tcpdump -i Port2 -n host 192.168.7.2 or host 132.163.96.2 -w /tmp/wanport.pcap

    Looking more at the WAN trace, looks like Sophos XG is incorrectly sending the reply to the WAN port!!! Why? Look at packet 3, 6, 9, etc.

Reply
  • 0

    The Wireshark captures used these commands, and I confirmed Port3 is my LAN and Port2 is my WAN:

    LAN: tcpdump -i Port3 -n host 192.168.7.2 or host 132.163.96.2 -w /tmp/lanport.pcap

    WAN:  tcpdump -i Port2 -n host 192.168.7.2 or host 132.163.96.2 -w /tmp/wanport.pcap

    Looking more at the WAN trace, looks like Sophos XG is incorrectly sending the reply to the WAN port!!! Why? Look at packet 3, 6, 9, etc.

Children
No Data
Unfiltered HTML