Strange data in weekly report
This site doesn't allow deletions of posts so I'm putting this here.
Sophos UTM Unauthorized access when downloading the network usage
Hi All,
Why is it that when I download the network usage under Logging & Reporting, choosing the Top clients (default), even on Top servers , the warning always said " Unauthorized access"? But when I tried a different option, I could download the…
Need advice on Datalink L2 configuration
Hi
We have a datalink L2, to communicate site A and Site B. On the Sophos site (site A), we receive the ip automatically, and can ping to gateway. On the site B, we have a unifi UTM (unifi UDM pro), we already make the firewall rule to able communicate…
how to setup BGP Ipv6
Hello,
I have got a Ipv6 prefix, and a network were already IPv4 is running. Now I have to setup IPv6 over the network and have to configure the firewalls.
This new for me and I don't have any examples
Does anyone have any tips or examples
The…
Access to Network UNC path and UTM 9
I have two UTM 9 on different locations (A, B) of our company. I want to access to machines on the locations B with UNC Path. The reason is that I have a application Server on the location B and I want to have access with UNC path \\appserver\text to…
[Sophos Firewall / Data Lake] Identify Attempts to Access Firewall by Country
SELECT
device_model,
--device_serial_id,
--app_name AS ProtoPort,
--in_interface,--
--src_mac,--
src_ip,
dst_ip,
src_country,
log_type AS Source_Log,
log_subtype AS Decision,
src_port,
dst_port
--protocol--
FROM xgfw_data
…
Sophos WAF: HTTP Error 500 with external access to SAP Business One
Hello,
I have a problem with Sophos WAF and the external access to specific SAP Business One Services.
The access works completly fine with NAT however the company would like to use WAF for providing external access. We get a HTTP ERROR 500 when trying…
IPv6 on WAN is not getting address
dear all
I have istalled SF 19 on my hyper-v W16 server. 3 virtual switches - one is connected directly with the servers NIC - for WAN.
My ISP provides IP addresses with DHCP. IPv4 - everything is OK. IPv6 should get local link address for WAN and…
Outbound SMB Traffic
I am trying to determine what process is generating outbound SMB traffic on a system. I can see the traffic in the firewall logs, but when I use the query below, nothing comes up. It doesn't matter which system I check, or whether I use port 137 or 445…
Team was unable to identify issue
I was assign to high priority work, but I can not connect to Sophos VPN, so I contacted to customer support team but team was inefficient to identify the problem, I do not recommend anyone to use their service, it was bad customer experience and waste…
Overruns on Eth0 with vlans
Not sure at what point this started happening, but users reported slow down with remote desktop sessions when a large burst of traffic from other vlans is being forwarded on other networks. The problem interface is Eth0 where we have vlans feeding into…
Sophos Factory (formerly Refactr) Native Fortigate and FortiAnalyzer Integrations
Fortinet and Sophos Factory have partnered to make integrating and automating Fortinet solutions with your existing DevSecOps processes easier than ever before. By integrating FortiGate and FortiAnalyzer with Refactr’s drag-and-drop automation platform…
Internet Connection loss XG 135
I am using my Sophos XG135 as a DHCP server and configured in gateway mode, Running firmware version SFOS 18.5.2 MR-2-Build380. Internet connection is only active for a period of a bout 20 minutes and then it is lost but the WAN interface shows it is…
How connect to an internal sub net behind UTM9
This is my network structure:
The Computers on the internal network are setup as 10.0.0.x/24 as well as the definition of the network on UTM9.
Behind the UTM9 firewall there is the Fritzbox, which is the gateway to the internet. For the FritBox…
Sonicwall VPN Connection
Sophos Endpoint Intercept X Since we updated to macOS Monterey 12.0 no VPN connection can be established with Sonicwall VPN (SonicWall Mobile Connect). The client asks for the password and then the connection immediately goes to Disconnected. If Sophos…
High time to have internet avalaible
Hello Everybody,
I have a couple of XG330 with OS at version 18.5.1 MR-1-Build326. Everything works well enough but I have some trouble when my people start or restart their computers and log on the domain. The time to have internet avalaible is very…
Sophos Endpoint Intercept X (Malicious Traffic Detection) slows down MacOS Monterey extremely
Hi all,
following issue: I upgraded different machines (4 for testing) to MacOS Monterey 12.0.1.
They got all the same issue: After upgrading and rebooting, the machines slowing down extremly.
The OS would hang with beach ball and take forever…
Apple Bonjour Forwarding
Hey folks,
I am trying to forward Apple Bonjour request from one VLAN to another VLAN.
The scenario is the following:
VLAN 10: Airplay devices (broadcasting) Wired clients
VLAN 20: client devices (MACOS) WiFi clients
The goal is to have…
Using UTM management log data to identify the IP of a known MAC address.
I have received a old network management card which I wish to use in my UPS to enable me to access it remotely. My problem is I do not know the configured IP address of the second card which had been used in another system and I suspect is configured…
WAF rule on 18.1.5 does not block in firewall level but in waf (403)
Hi,
I created a WAF rule, to allow only specific IPs, but they are blocked in WAF level displaying 403 error on the client
(Forbidden, You don't have permission to access this resource), instead in firewall level (drop/reject) as it used to be the…
DNS server behind XG firewall NAT
Hello community,
Recently i was asked to migrate an existint configuration from a router to XG firewall and here is the scenario :
an application running in my local server with the name :
transmission.local.co IP@ is 192.168.62.11
DNS serve r…
SOPHOS XG AND IDS SOLUTION
How can I integrate an IDS solution into an infrastructure that has a firewall at the edge (XG210) and an internal firewall (XG310). I understand that SOPHOS has the Discover deployment mode. But we would like to use another solution to collect this information…
Report showing interface drops?
XG125, SFOS 18.0.5 MR-5-Build586
We have redundant ISPs at a site. Email notifications reveal that one of the ISPs drops frequently, though briefly. The email notifications are sent once per minute, so we don't really know the exact time or duration…
Sophos Cloud Concentrator for Azure
Hello All,
We are looking to replace a MPLS with an alternate solution. The presumption is to prop up a cloud concentrator in the Azure environment and then place physical units on-prem @ various office. Can someone tell me if this can be accomplished…
Port scan detection using Sophos Firewall data in the Data Lake
In this query I correlate 'Appliace Access' log entries logged by the Sophos Firewall to see if someone ran a port scan against my IP address / appliance.
-- VARIABLE $$Ports_Seen_Threshold$$ String
-- Ignoring log entries with src_port 53 (DNS) due…