E-mail Services Blocked

Do you see anything related to those accesses in the Firewall or Web Filtering logs?

Cheers - Bob

No. That is part of the confusion. The fact that I am already bypassing the firewall for my devices, there is nothing (at least as logs are concerned) being blocked. It simply does not work.

Hi Juscelino,

Please make sure to have the logging option enabled and to set it on the first position of your Firewall Rules

to see allowed traffic processed by your Bypass rule (per default you'll only see droped traffic).

if you temporarily create a "Lan to Internet Allow Any, Log enabled" at the top of your rules you should be able to see the traffic caused by your devices.

if we know if and what traffic happens we should be able to see why it don't work.

Yours Lukas

Hi Juscelino,

Please make sure to have the logging option enabled and to set it on the first position of your Firewall Rules

to see allowed traffic processed by your Bypass rule (per default you'll only see droped traffic).

if you temporarily create a "Lan to Internet Allow Any, Log enabled" at the top of your rules you should be able to see the traffic caused by your devices.

if we know if and what traffic happens we should be able to see why it don't work.

Yours Lukas

Thank you for the suggestion. I created the rule. Does the following image of my firewall log help?

Hi Juscelino,

if you are not an google employee than this is not your work public ip.

the Subnet 172.217.0.0/16 is owned by google, are you using Gmail-Pro at work?

if not, we don't see any mail related traffic in this log.

is there anything in IPS log?

Yours Lukas

Lukas,

I know for a fact that our e-mails flow via Google, including SMTP relay and incoming messages. However, I also know for a fact that we connect all clients directly to an in-house Exchange Server. So my "rejections" are for certain to our in-house Exchange Server, located behind a Cisco ASA firewall. I can look around in the Cisco ASA firewall, but I am not an expert and do not know what to look for.

Here is the only thing that I see in my IPS log:

Interesting.  Try doubling the packets/second rates for UDP flooding on the 'Anti-DoS/Flooding' tab.  Does that fix your problem?

Cheers - Bob

I completely disabled UDP Flood Protection and same results.

That's not possible.  If UDP Anti-flooding is disabled, you won't have any blocks due to UDP flooding in the Intrusion Prevention log.

Cheers - Bob

Bob - I get what you are saying regarding disabling UDP Flood Protection. I did try doubling those rates and nothing changed. Any other ideas? I am so lost. This is so inconvenient.

Everyone - I am embarrassed to admit this, but you all deserve the truth. LOL. I have resolved my issue and it has nothing to do with my Sophos UTM. Although I suspected this from the beginning, I thought that it involved my work Cisco ASA. That was not it either. My issue was our web filtering system at work. We use iboss and for whatever reason I never suspected that it would suddenly start blocking my home traffic.

I guess it is good to be in charge of our network and able to resolve these issues with no questions asked. :-) Thank you all for your time.