Still understanding logs is a big problem and mistery. Some reports are still missing. We expect to see into 18.5 a new log module

Yeah, I agree. The logging could definitely be improved a lot.

Thanks Steppenwolf.

I would say "should!"

After googling Microsoft Teams, I found that UDP ports must be opened:

https://docs.microsoft.com/it-it/office365/enterprise/urls-and-ip-address-ranges

UDP: 3478, 3479, 3480, 3481

XG Firewall log was completely empty.Filtering for source ip and port, nothing came out.

Drop-packet-capture was the only way to undertand the blocked ports.

I will report the blocked traffic not logged in Firewall log bug in a new thread.

However, this does not change that logging is still very very difficult. I was like because ports were blocked, otherwise...

Hello,

sorry, my response is HAVE TO!!!

It is surprising that Sophos positions the XG Firewall as an enterprise firewall, but the many features as they are now implemented absolutely do not match this level. And the implemented log management module is proof of that.
I would like to see a situation when a security auditor at a bank or other financial company wanted complete logs from a XG Firewall administrator for a certain calendar period (day, week, month, etc.). I would not want to be in a skin of XG Firewall administrator, because he could not accomplish such a task. 

Is desperate that no one of the Sophos product management is looking at the development of this product from the perspective of the administrators of the product.

Well, we see the result.

Regards

alda

alda 

i.e. How do you create a report for understand how much blocked traffic was generated during last week? I know blocked traffic on rule ID 0 is huge, but I want to know, by analysing the traffic, calculate the blocked traffic trend.

Do you know, by using report, how can I accomplish this?

I agree 1000% with Luk.  When you have something that is not working properly, figuring out why via the log viewer is nearly an impossible task.  Many times the traffic simply doesn't appear in the log viewer even though it is hitting the XG.  Very frustrating.  

An official reply from Sophos Staff would be appreciated.

Thanks

First of all, you need a Default drop rule to log non matching Traffic. 

https://community.sophos.com/kb/en-us/133310

That is still the case in V18 EAP1. The Default drop rule in firewall was the first step, but it does not enable the logging like such a firewall rule with "all" zones would enable. That is something for a version ongoing. 

If you have such a rule in place, XG will log all traffic, which does not match. Easy to stop a non matching Traffic in Logviewer (port). 

TLS / SSL Errors will be improved. Currently the Apps are categorized "wrong", so to speak most apps are FTP/443. If fixed, it should be easy to spot your Teams Apps to find, if this app is not able to be decrypted. 

Myself, i work with tcpdump, drppkt and conntrack quite easily - Simply because i work day / night with XG. I know i cannot expect this by everyone, but its possible. Having the SSH Key in mobaxterm and you are fast to go for troubleshooting. But thats my way to interact all the time (even on UTM and other vendor products). 

Just my two cents about this topic. Its not a solution, just a personal opinion in regards this. 

Thanks Luca for your personal opinion. XG logging, compared to other brand, is back 10 years (at least). People are waiting for a complete re-design/re-engineering of logging module.

If you want to really work on XG to understand what's going on, you need to keep open several ssh connection with several tail -f and with other ssh connection conntrack, drop-packet-caputre and tcpdump.

This is not acceptable. It is a waste of time. People needs to use cli only in certain cases. On XG, you can use the log viewer 20% of time, the rest of troubleshooting is under cli (70%) and the rest of 10% is opening cases at Sophos.

Not all people are so expert in troubleshooting via CLI. I do not even talk how the certain logs are spread into .log files. Terrible design!

I do not even talk about reporting...

UTM had so much nice and complete reporting/logging module that few competitors have.