SFOS 18.0.3 MR-3 - reject or drop rules stopped working

After upgrading to SFOS 18.0.3 MR-3 our reject or drop rules stopped working for blocking WAN traffic.

I have the following top rule to test which is not working anymore :

Source zone: Any

Source networks and device: WAN_TEST - has my test external IP address

Destination zone: WAN, DMZ2

Destination networks:webdisk_public, DMZ2_webdisk - has the destination IP address 
Action: Reject

 
Parents
  • Sounds like the traffic is not matching this WAN IP anymore. 

    If you look at the packet capture, can you see this traffic going out? 

    Another question, why should this rule match in the first place? XG is aware of the origin of the traffic. Hence you can also block it from the traffic origin and not on the WAN Port. 

    __________________________________________________________________________________________________________________

  • I had a Sophos support engineer on the line for 1h and this issue has been escalated now as he confirmed reject/drop rules are not working on my appliance.  

    If you have migrated to 18.0.3 MR-3 check if your reject/drop rules are still working - just as a precaution.

  • Can you show us the logviewer and the firewall Rule as a screenshot?

    Because i have a guess, thats only 443/80 traffic(web)? 

    __________________________________________________________________________________________________________________

  • In this test yes it is 80/443 traffic, drop rule is ignored and I can see that traffic goes to the web publishing to a web server rule.

Reply Children