This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Interesting Hardware Bug

I wanted to install a HA device additional to the existing SG230 in one of our subsidiaries.

We had networking problems so I did a tcpdump on several interfaces and so internal traffic on outside interface and vice versa.

Result is (and this is a no-go for a Firewall of course!):

SG230 switched off and without power plugged in connected on Port eth0 to a switch, connecting a client on port eth1: client is connected to the network on the switch.

You see not also the hardware bug but the problem with eth0 and eth1 being the default interfaces for Internet and internal network.

Somebody else with this behaviour?

Waiting for RMA.

I guess it is a hardware problem of the Ethernet Chips, because the are serving two interfaces usually.

The same I see with eth2 and eth3.

This thread was automatically locked due to age.

Top Replies

LuCar Toni over 3 years ago in reply to FrankFiene +1 verified

This is a feature, clearly explained in the Product description. https://www.sophos.com/en-us/medialibrary/PDFs/factsheets/sophos-sg-series-appliances-brna.pdf

Parents

0 FrankFiene over 3 years ago

Sophos, seriously?

https://support.sophos.com/support/s/article/KB-000037092?language=en_US

WTF?

That sounds to me like "never buy a Security Appliance from Sophos again"!
Cancel
Vote Up 0 Vote Down

Cancel
+1 LuCar Toni over 3 years ago in reply to FrankFiene

This is a feature, clearly explained in the Product description. https://www.sophos.com/en-us/medialibrary/PDFs/factsheets/sophos-sg-series-appliances-brna.pdf

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Cancel
0 FrankFiene over 3 years ago in reply to LuCar Toni

The last links are not working, and that does not makes things better.

For a Firepower I can argue this, because this is usually running as an internal IPS.

But I would never do this with an Internet facing Firewall.

There is no reason!
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to FrankFiene

XG/SG can be placed in such environment as well. Many customer use this product as a internal IPS. And hence this feature needs to be on the hardware in the first place, Sophos placed it in both products. You can disable it, if you want, as its programmable.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 3 years ago in reply to LuCar Toni

I know. Will the settings in /sys filesystem be permanent, even if the system is down?

Usually this is not the case with /sys
Cancel
Vote Up 0 Vote Down

Cancel
+1 LuCar Toni over 3 years ago in reply to FrankFiene

Its programmable hardware. It will be affected for ever.

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Cancel
0 FrankFiene over 3 years ago in reply to LuCar Toni

OK, that is something.

I am working in IT-Security since 30 years but I have never seen this until today.

Default settings of any OS, espacially for Security systems, should be as secure as possible.

We don't have Security or networking specialists in every subsidiary.
Cancel
Vote Up 0 Vote Down

Cancel
0 Amodin over 3 years ago in reply to LuCar Toni

Isn't this really designed more for an end-to-end feature, such as office to office connection that doesn't house external traffic? I can see this as the only real option to use this, so long as its ultimately secured behind a DMZ, other existing firewall, etc., but not as an endpoint prior to external connectivity. Gaining internet traffic off of this in a bypass mode capacity negates any security if I understand this setup correctly.

OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
(Former Sophos UTM Veteran, Former XG Rookie)
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 3 years ago in reply to Amodin

What do you mean with "end-to-end" connection?

But for the rest I would agree!
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 3 years ago in reply to FrankFiene

And even for the behind a DMZ use case you mentioned, this must not be the default setting!
Cancel
Vote Up 0 Vote Down

Cancel
0 Amodin over 3 years ago in reply to FrankFiene

I'm referring to something like MPLS, and the provider can set it up so you have secure traffic from 'end to end' but internet flow traffic goes through a designated office.

And, I never disagreed with you on it being a bad decision to have on as a default setting.

OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
(Former Sophos UTM Veteran, Former XG Rookie)
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 3 years ago in reply to Amodin

OK, I don't want to trust a MPLS provider as well. So even then there should be no bypass.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 FrankFiene over 3 years ago in reply to Amodin

OK, I don't want to trust a MPLS provider as well. So even then there should be no bypass.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data