Externet Pentest

Hello MAIT_BuAy ,

Thanks for reaching out to Sophos Community. 

You may have to create a DNAT policy without any IPS, but turning on "Log Firewall Traffic"

FW policy may look like this:

*Source networks and devices: -Your allowed IP list where the traffic will be coming from.

Specify Services* and enable Log Firewall traffic. > Then preferably, put this FW rule on top of your list.

Hope this helps on your setup. Have a nice day and thank you for choosing Sophos. 

Regards,

Hello Raphael,

Thank you for the hint, I´'ll try it out.

As I´ve been informed the test will be executed next monday. I´'ll keep this thread updated when I get a response.

I wish you a relaxing weekend!

Thank you for your well wishes, yes please let us know of the outcome of your testing.

Regards,

Hello,

maybe you want to expand the list of "Services" to include more services than just HTTP and HTTPS.

Otherwise this would be a rather poor pentest.

OTOH, this is kind of a "passthrough" you would never allow during normal firewall operation.

So why not scheduling two rounds for the test: One time you have your IPS in place and you can see how it works.

Next round is with the "relaxed" setup like suggested from Raphael.

I would like to know both results, if I were you.

Hello,

Thank you for the ideas, as suggested by @PhillipRusch I advised my customer to activate the rule only if the pentest wouldn't deliver any results. The IPs worked as intended, the external scan didn't seem to have any unexpected difficulties except the port-scan taking longer (I can live with that).

Thank you for your support, let's see what the report suggests.