No connection via Secure MQTT to Gruenbeck Cloud on Port 8883

Question

Hello, 
 since two weeks, I use a Sophos XG as ma Home Router. It work's very good and my internet latency is very low since i switched from my old Asus Router to Sophos XG. I'm very happy to switched to Sophos XG. 
 But with one device I can not connect to the Internet. It's my Gruenbeck Water softener softliQ SD21. It will connect to the Gr&uuml;nbeck cloud with the Secure MQTT protocol on Port 8883. 
 I've tried some configurations. I tested different firewall configurations, analyzed them with the Log Viewer and the Diagnostic in the Web UI. The analysis with Wireshark didn't get me any further either. I am at a loss. Here is my configuration: 
 
 Using Sophos XG Home Edition V18 MR3 
 A firewall rule (#1) only for this device.

2. A linked NAT Rule (#1) 
 But I I get this result in the log viewer: 
 In the Wireshark trace you can see a TLS v1.2 Connection with a reply from the Gruebeck cloud, but this will not be forwarded to my device. Why? 
 
 Can anyone help me? 
 Thanks!

emmosophos · Answer

Hello Mephilius, 
 Thank you for the follow-up. 
 Not sure why your computer would be answering to the Helo, unless you have some routing issue, but I don't think you have two WAN address. 
 It seems like the 13.95.15.251 is asking for a certificate, in the Firewall for Web Filter for this computer, you are not using the Web Browser and/or DPI correct? Also try to bypass the IP from the SSL/TLS inspection rules. 
 
 Regards,

Mephilius · Answer

That was the key clue. Thanks for the tip!!! 
 So now I've found the cause. Unfortunately, I have no idea how to fix it. The reason is the SSL / TLS engine. If I deactivate it in the SSL / TLS settings, my connection is established 
 
 Unfortunately only the complete shutdown of the SSL / TLs engine helps. I've already tried just to switch off the inspection: 
 
 I have also tried different rules with my device and / or the service in question. It doesn't help. Anyone else have an idea how I can turn off the SSL / Engine for this device?

dirkkotte · Answer

So my hint "Possible the ssl/TLS-engine ... block parts of the traffic." seems to be correct. Try to add/build a SSL/TLS Exclusion rule containing "Don't decrypt" within SSL/TLSinspection rules. 
 This rule must be placed above the "Decrypt" rule

No connection via Secure MQTT to Gruenbeck Cloud on Port 8883

Top Replies