zero day inspection - where is the result published.

Question

Him 
 I have downloaded a file which the XGS decided needed investigation. 
 I have checked this thread and it does not provide the answer. 
 https://community.sophos.com/sophos-xg-firewall/f/discussions/147849/zero-day-protection---downloads-attachments 
 
 The question is how long does the zero day testing take on a 68kB file and where are the result published so I can download the file from the published link. 
 
 I have not provided the download link. 
 Why has the XGS chosen the VoIP interfaces as the place to download the file from, why not the main Lan interface?

rfcat_vk · Accepted Answer

Hi folks, 
 Port 8090 was not hittingthe firewall. I found and fixed the issue. I had disabled access to the user portal in ACL.When enabled I get an error message indicating the file cannot be found because it has possibly downloaded. 
 Ian

Michael Dunn · Answer

Port 8090 is the port that is used for almost all the "we need the browser to talk directly to the xg for web browsing purposes". Primarily / originally this was Captive Portal but is used for many other things since. So in device access it is called the Captive Portal port but there is a note at the bottom of the table. " Turning off access to captive portal stops user notifications from appearing. Example: Web filter and zero-day protection notification pages."

zero day inspection - where is the result published.

Top Replies