Firewall hacked?

Question

Hi, 
 After starting quite successful with the XG Firewall I now have an issue which forced me to turn off the firewall completely. What happened? Since a few days (during holidays) the network traffic both inbound and outbound went to the maximum of my DSL link. In order to analyze I first removed one machine after the other from the network with no effect until I realized that the firewall itself seems to be the source of the issue. Next I used the built in packet capture and it showed all the time incoming packets to the WAN interface of the firewall (with no forwarding to the LAN) to port 443 and then the same outbound again. The partner IP varied between several different ones like for instance 54.239.168.224 . I tried to apply policies to stop that traffic but it looks to me that I can only filter traffic between two interfaces. As the traffic is only to the device or from the device this did not help. To further narrow down the problem I disabled the port 443 communication already in my DSL modem / router and the traffic immediately went to normal behaviour. But obviously this is no solution as I need the port 443 available for regular operations. 
 Is my firewall hacked? Does anybody else have similar issues? Do you have any idea how to bypass or do I need to keep the Sophos XG Firewall turned off for security reasons? 
 Any help is very welcome :-) 
 Stefan

dempie · Accepted Answer

Maybe it's a problem with updating the Avira virus pattern as described in thread 'Avira up2date error: Is there any solution?' 
 https://community.sophos.com/products/xg-firewall/f/46/t/73626 
 The IP address that you mention resolves to Amazon's Cloudfont from where the XG firewall tries to download these files. Did you check the Log viewer under 'View Log for Admin'? Best Regards.

StefanZimmer · Answer

Hi again, I booted up the XG again and the issue seemed to be worked around by other methods. So to come back to one earlier question: yes, the logfile is showing also the Avira update attempts like you expected. 
In the meantime those no longer start downloading and fail but just fail immediately every minute, i.e. at least they are no longer blocking the bandwidth. 
I would not call the issue solved as per discussion in the other thread as it is quite frightening that the device that I am mainly using for traffic shaping is wasting all my bandwidth and this cannot be configured but needs tweaking underneath the surface. 
Thanks again for your important hint!