This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is it Possible that the Firewall won't detect eicar ? ( Malware-Scanner activated..)

Hi

Just setted up my new Sophos XG Firewall at home, but when I test the malware-scanner ( downloading EICAR-File) it won't be detected. malware-scanner is active, also in rule is it "on"

Any help is kindly appreciated!

Regards

This thread was automatically locked due to age.

0 Billybob over 9 years ago

I filed it as a bug during the beta but didn't get any feedback from the devs. Basically, if you define the services instead of ALL Services in your network policy, the proxy will bypass av scanning. www.astaro.org/.../59288-bug-beta2-defining-services-policies-bypasses-web-proxy.html
Cancel
Vote Up 0 Vote Down

Cancel
0 Chadwick24 over 9 years ago in reply to Billybob

The Eicar test files are not being blocked for me as well. I have the services defined as "ANY" but it still does not block the download. I'm concerned that the AV scanning is not working at all.
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 9 years ago in reply to Chadwick24

Try manually putting YOUR XG Firewall LAN address port 3128 in your browser configuration for proxy settings and see if it works.
Also can you please post your rule that is failing.
Cancel
Vote Up 0 Vote Down

Cancel
0 WayneBoyles over 9 years ago in reply to Chadwick24

Interestingly, for me they are being blocked if I try and download via Chrome. However, using IE they are NOT blocked. This is without changing the proxy to go through the XG firewall.

Not sure why Chrome would work and IE wouldn't, must something in the way Sophos sees the traffic in the different browsers.
Cancel
Vote Up 0 Vote Down

Cancel
0 mod2402 over 9 years ago in reply to WayneBoyles

I can acknowledge this behavior
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 9 years ago

I change my policy rule from Http/s to any and eicar has been detected. Make sure you set scan http. Also make sure that scanning is in batch mode under Web Protection > Web Content Filter.

Luk
Cancel
Vote Up 0 Vote Down

Cancel
0 dempie over 9 years ago in reply to Billybob

Sorry posted twice. Please see other message.
Cancel
Vote Up 0 Vote Down

Cancel
0 dempie over 9 years ago in reply to Billybob

I can't confirm that. My network rule restricts the services to web ports (80 and 443) and ftp ports (21,990). Furthermore I am using the firewall in transparent proxy mode. In my setup the XG firewall is able to detect the eicar test file from eicar.org. See screenshots below.
Cancel
Vote Up 0 Vote Down

Cancel
0 dempie over 9 years ago in reply to WayneBoyles

>>Not sure why Chrome would work and IE wouldn't, must something in the way Sophos sees the traffic in the different browsers.

In my setup it also works with IE. See screenshot below.
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 9 years ago in reply to dempie

dempie said:
My network rule restricts the services to web ports (80 and 443) and ftp ports (21,990). Furthermore I am using the firewall in transparent proxy mode.
The bug that I filed was originally for non transparent traffic. But as you can see something is not right with the transparent intercept of traffic also. In any case, this probably won't get fixed till someone calls support.
Cancel
Vote Up 0 Vote Down

Cancel