This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Interesting Hardware Bug

I wanted to install a HA device additional to the existing SG230 in one of our subsidiaries.

We had networking problems so I did a tcpdump on several interfaces and so internal traffic on outside interface and vice versa.

Result is (and this is a no-go for a Firewall of course!):

SG230 switched off and without power plugged in connected on Port eth0 to a switch, connecting a client on port eth1: client is connected to the network on the switch.

You see not also the hardware bug but the problem with eth0 and eth1 being the default interfaces for Internet and internal network.

Somebody else with this behaviour?

Waiting for RMA.

I guess it is a hardware problem of the Ethernet Chips, because the are serving two interfaces usually.

The same I see with eth2 and eth3.

This thread was automatically locked due to age.

Top Replies

LuCar Toni over 3 years ago in reply to FrankFiene +1 verified

This is a feature, clearly explained in the Product description. https://www.sophos.com/en-us/medialibrary/PDFs/factsheets/sophos-sg-series-appliances-brna.pdf

Parents

0 FrankFiene over 3 years ago

Sophos, seriously?

https://support.sophos.com/support/s/article/KB-000037092?language=en_US

WTF?

That sounds to me like "never buy a Security Appliance from Sophos again"!
Cancel
Vote Up 0 Vote Down

Cancel
+1 LuCar Toni over 3 years ago in reply to FrankFiene

This is a feature, clearly explained in the Product description. https://www.sophos.com/en-us/medialibrary/PDFs/factsheets/sophos-sg-series-appliances-brna.pdf

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Cancel
0 FrankFiene over 3 years ago in reply to LuCar Toni

Yes, but this is default behaviour and Firewalling and Bypass does not make any sense together.

Especially with default settings.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to FrankFiene

Its a hardware bypass within the hardware, if there is no power. So your suggestion would be to disable this feature per default?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 3 years ago in reply to LuCar Toni

I cannot see any reason why a not running Firewall even without power plugged in should bypass traffic from Internet to internal network and vice versa.

If this is a hardware "feature", Sophos must change the hardware.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to FrankFiene

Most vendors offer such a feature for disaster cases.

See: https://www.cisco.com/c/en/us/td/docs/security/Firewalls/ISA3000/hardware/ISA3000hwinst/hwbypass.pdf

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk85560

https://kb.fortinet.com/kb/documentLink.do?externalID=FD34937

Just to name a few.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 3 years ago in reply to LuCar Toni

The last links are not working, and that does not makes things better.

For a Firepower I can argue this, because this is usually running as an internal IPS.

But I would never do this with an Internet facing Firewall.

There is no reason!
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to FrankFiene

XG/SG can be placed in such environment as well. Many customer use this product as a internal IPS. And hence this feature needs to be on the hardware in the first place, Sophos placed it in both products. You can disable it, if you want, as its programmable.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 3 years ago in reply to LuCar Toni

I know. Will the settings in /sys filesystem be permanent, even if the system is down?

Usually this is not the case with /sys
Cancel
Vote Up 0 Vote Down

Cancel
+1 LuCar Toni over 3 years ago in reply to FrankFiene

Its programmable hardware. It will be affected for ever.

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Cancel
0 FrankFiene over 3 years ago in reply to LuCar Toni

OK, that is something.

I am working in IT-Security since 30 years but I have never seen this until today.

Default settings of any OS, espacially for Security systems, should be as secure as possible.

We don't have Security or networking specialists in every subsidiary.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 FrankFiene over 3 years ago in reply to LuCar Toni

OK, that is something.

I am working in IT-Security since 30 years but I have never seen this until today.

Default settings of any OS, espacially for Security systems, should be as secure as possible.

We don't have Security or networking specialists in every subsidiary.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data