0% found this document useful (0 votes)

42 views130 pages

Network Protection Module Overview

Module 2 of the Network Protection course covers various topics including firewall flow, XStream architecture, and troubleshooting techniques for NAT, routing, and IPS settings. The module aims to equip participants with the skills to troubleshoot advanced deployments and understand firewall subsystems. Additionally, it provides practical commands for managing iptables and ipsets for effective network protection.

Uploaded by

marcos.converg

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

42 views130 pages

Network Protection Module Overview

Uploaded by

marcos.converg

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

So

Module 2 – Network Protection handout

Supportability guide

Version 20.0 July 2024

Module 2 – Network Protection

Course Agenda
• Module 1: Architecture and Troubleshooting basics
• Module 2: Network Protection
• Module 3: Web Protection
• Module 4: Email Protection
• Module 5: Web Server Protection
• Module 6: Authentication
• Module 7: Synchronized Security and Central Management
• Module 8: Virtual Private Networks
• Module 9: Wireless
• Module 10: High Availability
• Module 11: XGS Hardware and Troubleshooting

Module 1: Architecture and Troubleshooting basics

Module 2: Network Protection
Module 3: Web Protection
Module 4: Email Protection
Module 5: Web Server Protection
Module 6: Authentication
Module 7: Synchronized Security and Central Management
Module 8: Virtual Private Networks
Module 9: Wireless
Module 10: High Availability
Module 11: XGS Hardware and Troubleshooting

Page 2 of 130
Module 2 – Network Protection

Module objectives
Once you complete this module you will be able to:
ü Describe firewall flow and the XStream architecture
ü Understand and Troubleshoot Fastpath related issue
ü Troubleshoot the Rules and Policies
ü Troubleshoot Enterprise NAT
ü Understand and Troubleshoot Routing related issues and FRR
ü Understand SD WAN Load Balancing
ü Understand the Fine Tuning IPS settings available in the CLI
ü Understand the advanced firewall settings
ü Troubleshoot Advance deployment with VLAN and Extended Bridge
ü Troubleshoot Dynamic DNS and Jumbo Frame
ü Understand the SNMP Troubleshooting

Once you complete this module you will be able to:

ü Describe firewall flow and Troubleshooting
ü Describe the XStream architecture
ü Understand and Troubleshoot Fastpath related issue
ü Troubleshoot the Rules and Policies
ü Troubleshoot Enterprise NAT
ü Understand and Troubleshoot Routing related issues
ü Understand the Fine Tuning IPS settings available in the CLI
ü Understand the advanced firewall settings
ü Troubleshoot Advance deployment with VLAN and Extended Bridge
ü Troubleshoot Dynamic DNS and Jumbo Frame
ü Understand the SNMP Troubleshooting

Page 3 of 130
Module 2 – Network Protection

Firewall Framework and Xstream

Architecture

Page 4 of 130
Module 2 – Network Protection

Firewall Framework flow 5. Filter

Forwarded traffic

PREROUTING ROUTING FORWARD POSTROUTING

Incoming Outgoing
packets packets

1. RAW packet processing

2. Conntrack 6. Mangle
3. Mangle 7. Filter
4. DNAT 8. Conntrack
9. NAT

Tables
Packet Filter
NAT

Firewall Framework Flow

Forwarded traffic
This scenario shows how the Sophos Firewall interacts with traffic that it is flowing through the device,
either inbound or outbound.
Firewall subsystems offer a way to intercept and manipulate the packets at the different positions in a
network stack in order to implement the firewall functionality. These subsystems are:
• Prerouting
• Forwarding
• Postrouting
PREROUTING
• Protocol anomaly checks are performed on incoming packets. If necessary, fragmented packets are
reassemble prior to these checks
• After anomaly check packets are processed through DOS & Spoof prevention modules. If the traffic
is for the local loopback interface or HA dedicated interface the packets will be bypass the DoS &
Spoof check
• In the next stage packets are submitted to the connection tracking module (Conntrack). If packet
doesn’t match an existing connection a new entry is created. If the packet matches an existing
connection the packet is associated with it. If the connection is Related (e.g. FTP connection) then a
child connection entry is added, which is then associated with it’s parent connection entry
• The packet is associated with a user ID based on the source IP address
• The packet state is inspected , and packets with an invalid state are dropped
• For the first packet in a connection the link ID is set as per configured routes for multilink
management, then the packets is associates with its destination zone
• DNAT rules are applied
[Click]
FORWARD

Page 5 of 130
Module 2 – Network Protection

• Packets undergo application classification, and are associated with an application where possible
• The packets pass through the packet filter based on the firewall rules
• If the packet is accepted it will be submitted to the IPS if it is applied to the matching firewall rule,
or it will go straight to POSTROUTING
[Click]
POSTROUTING
• If the packet is the first in the connection, the masquerading and SNAT policies are checked and
applied to the packet. For existing connections the already matched NATing policy is used
• The connection tracking module entries are updated
• If HA load balancing is enabled, the packet is sent to the load balancer
• Finally, Quality of Service is applied

Page 6 of 130
Module 2 – Network Protection

Firewall Framework flow

System destined traffic

PREROUTING ROUTING ROUTING OUTPUT POSTROUTING Outgoing

Incoming
packets packets

8. Conntrack 10. Mangle

1. RAW packet processing 9. NAT 11. Filter
2. Conntrack INPUT 12. Mangle
3. Mangle 13. Filter
4. DNAT 14. Conntrack
5. Mangle OUTPUT ROUTING 15. NAT
6. Filter
7. Conntrack

Tables Local Processes

Apache

SSLVPN
Access
Packet Filter Server
Proxy

Proxy
HTTP

IPsec
WAF
Mail

AV
NAT

Firewall Framework Flow

System destined traffic

This scenario shows how the Sophos Firewall interacts with traffic that terminate on the device and new
traffic generated by the device, either inbound or outbound. For example, traffic for Web Server
Protection terminates on the Sophos Firewall on a virtual server, and a new onward connection is made to
the backend server that is being protected.
Firewall subsystems offer a way to intercept and manipulate the packets at the different positions in a
network stack in order to implement the firewall functionality. These subsystems are:
• Prerouting
• INPUT [System-destined]
• OUTPUT [System-generated]
• Postrouting

PREROUTING
• The prerouting module performs all of the same functions as if the packet was being forwarded
through the firewall as in the previous example
[Click]
INPUT
• The INPUT module applies to all packets that are destined for the device
• The packets pass through the packet filter based on the firewall rules defined
• If packet is accepted by the firewall it is directed to IPS & Application filter. It interfacing with IPS &
Application filter for forwarded and proxy traffic
• The connection tracking module entries are updated
• If the HA load balancer is configured it will process the packet, otherwise it will be submitted to
Local Processes

Page 7 of 130
Module 2 – Network Protection

[Click]
OUTPUT
• OUTPUT module applies to the traffic that is generated by the device
• Packets are submitted to the connection tracking module (Conntrack). If packet doesn’t match an
existing connection a new entry is created. If the packet matches an existing connection the packet
is associated with it. If the connection is Related (e.g. FTP connection) then a child connection entry
is added, which is then associated with it’s parent connection entry
• DNAT rules are applied to the packet
[Click]
• The packets pass through the packet filter based on the firewall rules defined
• The packet is submitted to the IPS if it is applied to the matching firewall rule, or it will go straight
to POSTROUTING
[Click]
POSTROUTING
• The postrouting module performs all of the same functions as if the packet was being forwarded
through the firewall as in the previous example

Page 8 of 130
Module 2 – Network Protection

Troubleshooting IPtables
Verify iptables
# iptables -nvxL
Chain INPUT (policy DROP 0 packets, 0 bytes) List of IPtables
pkts bytes target prot opt in out source destination optimization
0 0 ALLOW_ALL all -- * * [Link]/0 [Link]/0 skip_entry
0 0 HA_TRAFFIC all -- * * [Link]/0 [Link]/0 skip_entry
...............
IPtables list with line numbers
# iptables -nvxL --line-number
Chain INPUT (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
optimization
1 0 0 ALLOW_ALL all -- * * [Link]/0 [Link]/0 skip_entry
2 0 0 HA_TRAFFIC all -- * * [Link]/0 [Link]/0 skip_entry
...............
Display specific IPtable
# iptables -nvxL -t mangle
Chain PREROUTING (policy ACCEPT 6902 packets, 1509414 bytes)
pkts bytes target prot opt in out source destination optimization
1572 19811 ACCEPT all -- * * [Link]/0 [Link]/0 skip_ip_match
state UNTRACKED
0 0 ALLOW_ALL all -- * * [Link]/0 [Link]/0 skip_entry
0 0 HA_TRAFFIC all -- * * [Link]/0 [Link]/0 skip_entry
...............
To save/list IPtable configuration
# iptables-save
# Generated by iptables-save v1.6.2 on Wed Dec 4 18:41:48 2019
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
...............

Troubleshooting Iptables
Verify iptables
“iptables -nvxL ” Checking the status of IPTables / Firewall. Options “-L” (List ruleset), “-v” (Verbose) and “-
n” (Displays in numeric format).
[Click]
“iptables -nvxL --line-number ” Display IPTables rules with numbers. With the help of argument “–line-
numbers” you can append or remove rules.
[Click]
“iptables -nvxL -t mangle ” Display a specific table from Iptable
[Click]
“iptables-save ” To save/list the iptables configuration

Page 9 of 130
Module 2 – Network Protection

Troubleshooting IPsets
IPsets are a match extension for iptables
# ipset -L | more
Name: hb_green
Type: hash:ip List out all output of
..........
Name: hb_yellow IPset tables
Type: hash:ip
Revision: 4
..........

# ipset -L fwrules
Name: fwrules
List out detail about
Type: bitmap:fwrule firewall rule IPset
Number of entries: 5
Members:
FwRuleId=1,Action=ACCEPT,PolicyType=NETWORK
1,0,0,0,0
FwRuleId=2,Action=LOGDROP,PolicyType=USER
2,0,0,0,0
..........
# ipset -L localserviceset
List out detail about
Name: localserviceset particular set
Type: bitmap:service
Members:
1,tcpudp,6,1024,65535,80,80
2,tcpudp,6,1024,65535,4444,4444
..........

Troubleshooting Ipsets
IPsets are a match extension for iptables

ipset is a "match extension" for iptables. To use it, you create and populate uniquely named "sets" using
the ipset command-line tool, and then separately reference those sets in the match specification of one or
more iptables rules. A set is simply a list of addresses stored efficiently for fast lookup.
Advanced shell command
ipset -L : To list out all output of IPset tables
ipset -L <set name> : To list out detail about particular set
# ipset -L
Name: hb_green
Name: hb_yellow
Name: hb_red
Name: hb_lost
Name: hb_missing
Name: hb_magic
Name: heartbeat
Name: users
Name: scheme
Name: hotspotmacset
Name: hotspotusers
Name: lusers
Name: lusers6
Name: ip4ifacefpset
Name: ip6ifacefpset
Name: macifacefpset

Page 10 of 130
Module 2 – Network Protection

Name: l2host_##staticarp
Name: l2host_##staticneigh
Name: bandwidthset
Name: csvhost_##ALL_SSLVPN_RW
Name: csvhost_##ALL_SSLVPN_RW6
Name: fwrules
Name: tlsrules
Name: hostset
Name: serviceset
Name: localserviceset
Name: nonhttpserviceset
Name: l2host_##knownhosts
Name: l2host_##knownmachosts
Name: l2host_##ipmachosts
Name: l2host_##ipmachosts6
Name: vhostset
Name: MLM4WSTICKY
Name: MLM6WSTICKY
Name: appset
Name: deny_admin
Name: deny_admin6
Name: SYN_FLOODER_SRC
Name: UDP_FLOODER_SRC
Name: ICMP_FLOODER_SRC
Name: IP_FLOODER_SRC
Name: SYN_FLOODER_DST
Name: UDP_FLOODER_DST
Name: ICMP_FLOODER_DST
Name: IP_FLOODER_DST
Name: SYN_FLOODER_SRC6
Name: UDP_FLOODER_SRC6
Name: ICMP_FLOODER_SRC6
Name: IP_FLOODER_SRC6
Name: SYN_FLOODER_DST6
Name: UDP_FLOODER_DST6
Name: ICMP_FLOODER_DST6
Name: IP_FLOODER_DST6
[Click]
List out detail about firewall rule Ipset
# ipset -L fwrules
Name: fwrules
Type: bitmap:fwrule
Revision: 0
Header:
Size in memory: 65860
References: 6
Number of entries: 2

Page 11 of 130
Module 2 – Network Protection

Members:
FwRuleId=2,Action=ACCEPT,PolicyType=NETWORK
2,19167,3008431,87618,113909806
FwRuleId=5,Action=ACCEPT,PolicyType=NETWORK
5,0,0,0,0
[Click]
List out detail about particular set
# ipset -L localserviceset
Name: localserviceset
Type: bitmap:service
Revision: 0
Header: size 512
Size in memory: 8216
References: 56
Members:
1,tcpudp,6,1024,65535,80,80
2,tcpudp,6,1024,65535,4444,4444
4,tcpudp,6,1024,65535,22,22
5,tcpudp,17,1,65535,6060,6060,6,1024,65535,9922,9922
6,tcpudp,6,1024,65535,8090,8090
7,tcpudp,6,1024,65535,3128,3128
8,tcpudp,17,1,65535,53,53,6,1024,65535,53,53
9,icmp,1,8,0
10,tcpudp,6,1,65535,8443,8443
11,tcpudp,6,1024,65535,8091,8091
12,icmp,58,128,0
13,tcpudp,17,1,65535,1813,1813
14,tcpudp,6,1024,65535,2712,2712,17,1,65535,415,415,17,1,65535,8472,8472
15,tcpudp,6,1024,65535,273,273
16,tcpudp,6,1024,65535,179,179
17,tcpudp,6,1024,65535,1723,1723
18,tcpudp,17,1,65535,161,161
19,tcpudp,17,1,65535,520,520
20,tcpudp,17,1,65535,53,53,6,1024,65535,53,53
21,tcpudp,17,1,65535,1701,1701
22,tcpudp,17,1,65535,500,500,17,1,65535,4500,4500
23,tcpudp,6,1024,65535,25,25
24,tcpudp,6,1024,65535,464,464
25,tcpudp,6,1024,65535,142,142
26,tcpudp,6,1024,65535,109,109
27,tcpudp,6,1024,65535,994,994
28,tcpudp,6,1024,65535,992,992
29,tcpudp,6,1024,65535,2121,2121
32,tcpudp,17,1,65535,546,546,17,1,65535,547,547
33,tcpudp,6,1024,65535,8347,8347
34,tcpudp,6,1024,65535,3400,3400,17,1,65535,3410,3410,17,1,65535,3400,3400
37,tcpudp,6,1024,65535,8094,8094

Page 12 of 130
Module 2 – Network Protection

38,tcpudp,6,1024,65535,443,443
39,tcpudp,17,1,65535,520,520,6,1024,65535,179,179
40,ip,89,103,2
41,tcpudp,6,1024,65535,4501,4501,6,1024,65535,4502,4502
43,ip,210,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,1
65,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189
,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,211,212,213,214,2
15,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239
,240,241,242,243,244,245,246,247,248,249,250,251,252
45,tcpudp,6,1024,65535,65123,65123
46,servicegp,2,4,5,6,17,21,38
47,tcpudp,6,1024,65535,25,25,6,1024,65535,464,464
48,ip,1,89,2,103,41,4
49,tcpudp,6,1024,65535,25,25,6,1024,65535,464,464,6,1024,65535,142,142,6,1024,65535,109,109,6,1024
,65535,994,994,6,1024,65535,992,992,6,1024,65535,2121,2121
50,servicegp,7,47
51,tcpudp,6,1024,65535,22,22,6,1024,65535,8090,8090,17,1,65535,53,53,6,1024,65535,53,53,17,1,65535,
161,161,17,1,65535,53,53,6,1024,65535,53,53,6,1024,65535,25,25,6,1024,65535,464,464,17,1,65535,546,
546,17,1,65535,547,547
52,ip,58,41,4
53,tcpudp,6,1024,65535,25,25,6,1024,65535,464,464,6,1024,65535,142,142,6,1024,65535,109,109,6,1024
,65535,994,994,6,1024,65535,992,992
54,servicegp,7,51,52
55,ip,41
56,ip,4
57,tcpudp,17,546,547,546,547
61,servicegp,2,4,5,6,7,8,9,10,13,14,18,23,38,45
62,servicegp,2,4,6,7,8,10,12,18,23,38,45
63,servicegp,9,10,38
64,servicegp,10,12,38
65,servicegp,4,9,18,38
66,servicegp,4,12,18,38
69,servicegp,18,38
70,servicegp,18,38
71,servicegp
72,servicegp
73,servicegp,2,4,5,6,7,8,9,13,14,18,23,38,45
74,servicegp,2,4,6,7,8,12,18,23,38,45
75,servicegp,9,38
76,servicegp,12,38

Page 13 of 130
Module 2 – Network Protection

Xstream Architecture

Network
Flow
FastPath

DPI Engine
Xstream
Architecture

New SSL
Inspection
engine

Xstream Architecture
A new streaming packet processing architecture that provides extreme levels of protection, performance
and SSL policy is decoupled from firewall [Link] key components of the new architecture:

• Xstream DPI Engine - Deep packet threat protection in a single streaming engine for AV, IPS, Web, App
Control, and SSL Inspection. Deep packet threat protection in a single, high-performance streaming
engine with proxy-less scanning of all traffic for antivirus, IPS, and web threats as well as providing
application control and SSL inspection.
• Xstream SSL Inspection - Industry-leading performance, flexibility, and transparency into all SSL/TLS-
encrypted traffic. High-performance, high connection- capacity support for TLS 1.3 and all modern
cipher suites providing extreme SSL inspection performance across all ports, protocols, and
applications. It also comes equipped with enterprise-grade controls to optimize security, privacy, and
performance.
• Xstream Network Flow FastPath - Automatic and policy-based intelligent offloading of trusted traffic
processing at wire speed.

Page 14 of 130
Module 2 – Network Protection

FastPath and Rule Troubleshooting

Page 15 of 130
Module 2 – Network Protection

FastPath
Enabling FastPath and VFP/USFP kernel modules
console> system firewall-acceleration enable
Firewall Acceleration Enabled Successfully.
XG/SG/CR
# lsmod | grep vfp Hardware with
vfp_firewall 22200320 0 SFOS
debug_cntrs 16384 1 vfp_firewall
fp2sp_api 16384 1 vfp_firewall
......

# lsmod | grep -i usfp XGS Hardware

usfp_firewall 122880 0
fp2sp_api 16384 1 usfp_firewall
debug_cntrs 16384 1 usfp_firewall
........

FastPath
Enabling FastPath and VFP/USFP kernel modules

You can check the status of FastPath on the XG/XGS Firewall with the command:
console> system firewall-acceleration show
This command can also be used to enable and disable FastPath.
console> system firewall-acceleration enable
Firewall Acceleration Enabled Successfully.
console> system firewall-acceleration disable
Firewall Acceleration Disabled Successfully.

Virtual FastPath supports the NIC drivers i40e, e1000, e1000e, igb, ixgbe, and vmxnet3. VFP won’t load on
other drivers, but Sophos Firewall (including the DPI engine) still functions fully, but without
the FastPath performance enhancements. Currently, Virtual FastPath supports up to 3500 MTU on e1000
and e1000e NICs.
For virtual deployments, Virtual FastPath supports the VMware ESXi hypervisor. For other hypervisors,
such as KVM, turn off FastPath using the CLI command for firewall acceleration.
For XG/SG/CR Hardware with SFOS, With the command # lsmod | grep vfp we can verify that the vfp
module is loaded.
For XGS Hardware, With the command # lsmod | grep usfp we can verify that the usfp module is loaded.
Note: If the firewall-acceleration is enable/disable, the link state of the ports will bounce which would
fluctuate Interface.

Page 16 of 130
Module 2 – Network Protection

Troubleshooting FastPath
Using conntrack to detect offloaded traffic
# conntrack -L | grep [Link]
proto=icmp proto-no=1 timeout=29 orig-src=[Link] orig-dst=[Link] type=8 code=0 id=61219
packets=4 bytes=336 reply-src=[Link] reply-dst=[Link] type=0 code=0 id=61219 packets=4 bytes=336
mark=0x8001 use=1 id=1285035584 masterid=0 devin= devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0
icapid=0 policytype=0 fwid=0 natid=0 fw_action=0 bwid=0 appid=0 appcatid=0 hbappid=0 hbappcatid=0
dpioffload=0 inzone=0 outzone=0 devinindex=0 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x200000 flags1=0x0
flagvalues=21 catid=0 user=0 luserid=0 usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=00:0c:29:04:ee:aa
src_mac=00:50:56:ef:85:67 startstamp=1567580922 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0
hostrev[1]=0 ipspid=0 diffserv=0 loindex=0 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0
current_state[0]=5 current_state[1]=5 vlan_id=0 inmark=0x0 brinindex=0 sessionid=129 sessionidrev=27792
session_update_rev=0 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 conn_fp_id=NOT_OFFLOADED

Fastpath is
not offloaded
# conntrack -L | grep [Link]
proto=icmp proto-no=1 timeout=29 orig-src=[Link] orig-dst=[Link] type=8 code=0 id=1 packets=4
bytes=240 reply-src=[Link] reply-dst=[Link] type=0 code=0 id=1 packets=4 bytes=240 mark=0x8001 use=1
id=2422064384 masterid=0 devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0
policytype=1 fwid=5 natid=2 fw_action=1 bwid=0 appid=0 appcatid=0 hbappid=0 hbappcatid=0 dpioffload=0xd
sigoffload=0 inzone=1 outzone=2 devinindex=10 devoutindex=11 hb_src=0 hb_dst=0 flags0=0x800a0000200008
flags1=0x5c000804000 flagvalues=3,21,41,43,55,78,87,102,103,104,106 catid=0 user=0 luserid=0 usergp=0
hotspotuserid=0 hotspotid=0 dst_mac=7c:5a:1c:bc:06:ae src_mac=e8:d8:d1:45:62:89 startstamp=1617256606
microflowid[0]=5656 microflowrev[0]=0 microflowid[1]=5934 microflowrev[1]=0 hostrev[0]=1 hostrev[1]=1
ipspid=0 diffserv=0 loindex=11 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0
Fastpath is
current_state[0]=12 current_state[1]=12 vlan_id=0 inmark=0x0 brinindex=0 sessionid=197 sessionidrev=18941
session_update_rev=1 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=8 nhop_id[1]=10
nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=13 conn_fp_rev=2 offloaded

Troubleshooting FastPath
Using conntrack to detect offloaded traffic

If the connection is not offloaded that means traffic passes through the SlowPath which can be checked
from conntrack -L output for given conntrack will show conn_fp_id=NOT_OFFLOADED

If the connection is offloaded that means that traffic passes through the Fastpath then in that case :
conn_fp_id will display the fastpath connection id ex. conn_fp_id = 13

Note: connf_fp_id is based on the current state of conntrack, i.e it will tell that at that very moment
whether the conntrack is offloaded or not

Page 17 of 130
Module 2 – Network Protection

Troubleshooting FastPath
Slowpath Script – VFP & USFP
# sh /scripts/firewall/slowpath_debug_cntrs.sh
br_nhop_err : 0
create_conn_err : 0
del_conn_err : 0
l2_nhop_err : 0
l3_nhop_err : 0
lag_nhop_err : 0
lif_update : 20
modify_conn_err : 0
offload_error : 68
reclaim_conn_err : 0
reclaim_conn_incr : 36
skip_bridge_offload : 0
skip_helper_module : 30
skip_mflow_invalid : 0
skip_offload_dos : 0
skip_offload_ipv6 : 0
skip_offload_qos : 0
track_conn_err : 0
track_conn_incr : 155
traffic_flow_fp : 192 tcpdump forces all traffic flow
through slowpath
# tcpdump -ni any host [Link]

Troubleshooting FastPath
Slowpath Script – VFP & USFP
The slowpath counter can help us to identify any errors where data is originally marked for fastpath which
then fallsback to the slowpath.
For example, if a tcpdump is being run, this will force all traffic to be sent through the slowpath. If this
were the case, the offload_error counter will be incremented.
Note: A detailed breakdown of fastpath troubleshooting can be found in the following articles:
[Link]
[Link]
h

Page 18 of 130
Module 2 – Network Protection

Troubleshooting FastPath
VFP troubleshoot script
• Creates a tarball of useful info for debugging VFP
o Includes system info, syslog, debug counters, fastpath tables, nic driver info,
conntrack info, general system state info.

# sh /bin/fp_firewall_troubleshoot

VFP troubleshoot information will be saved to /var/tmp folder

Please review the contents of /var/tmp/fp_fw

Archive: /var/tmp/archives/fp_fw-[Link]

Troubleshooting FastPath
VFP troubleshoot script
If an issue arises where fastpath is suspected to be the issue, it is important to collect all relevant fastpath
information by running the following script for future use.
# cd /var/vfp
# ls
log vfp_troubleshoot_2020-02-16_20-55-42
# tar -xzvf vfp_troubleshoot_2020-02-16_20-[Link]

Page 19 of 130
Module 2 – Network Protection

Troubleshooting FastPath
USFP Fastpath Script
• Creates a tarball of useful info for the debugging
o Includes FastPath Counters, Daq/Snort Info, XFP RPC counters, Interface config,
Interface counters, Netmap info, Slowpath counters, System utilization, Kernel
counters, XGS Platform info, Marvell NPU dump, x86/NPU logs, Tuning info,
Versions.

# sh /bin/fp_firewall_troubleshoot

USFP troubleshoot information will be saved to /var/tmp folder

Please review the contents of /var/tmp/fp_fw

Archive: /var/tmp/archives/fp_fw-[Link]

Troubleshooting FastPath: Script

USFP Fastpath Script
For traffic handled by the NPU, run the equivalent command:
# sh /bin/fp_firewall_troubleshoot
Sample output is below:
Troubleshoot Information
Saving FP Counters ...
Saving Daq/Snort Info ...
……
……
fp_fw-sysinfo-localhost-2021-04-01.1328/fp_fw/kernel_counters_000.txt
fp_fw-sysinfo-localhost-2021-04-01.1328/fp_fw/marvell_dump.txt
done
Please review the contents of /var/tmp/fp_fw
Archive: /var/tmp/archives/fp_fw-[Link]

Page 20 of 130
Module 2 – Network Protection

Troubleshooting Firewall
Rules and Policies

Page 21 of 130
Module 2 – Network Protection

Troubleshooting Rules and Policies

Using conntrack
# conntrack -E | grep [Link]
[NEW] proto=icmp proto-no=1 timeout=30 orig-src=[Link] orig-
dst=[Link] type=8 code=0 id=1 [UNREPLIED] reply-src=[Link] reply-
dst=[Link] type=0 code=0 id=1 mark=0x8001 id=25578944 masterid=0
devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0
icapid=0 policytype=1 fwid=5 natid=2 fw_action=1 bwid=0 appid=0
appcatid=0 hbappid=0 hbappcatid=0 dpioffload=0x1 inzone=1 outzone=2
devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a8000200000
flags1=0x800000 flagvalues=21,39,41,43,55,87 catid=0 user=0 luserid=0
usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=00:0c:29:04:ee:a0
src_mac=00:0c:29:f5:fa:4c startstamp=1567211027 microflow[0]=INVALID
microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0
loindex=6 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0
current_state[0]=5 current_state[1]=0 vlan_id=0 inmark=0x0 brinindex=0
sessionid=92 sessionidrev=19168 session_update_rev=1 dnat_done=0
upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=65535
nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED

Troubleshooting Rules and Policies

Using conntrack
In this example, conntrack contains entries for the relevant connection being marked for firewall rule ID 5
and nat ID 2. We need to match same fwid and nat which we got from conntrack with respective
configuration in UI to confirm UI configuration is matching to the relevant conntrack.
This commands shows Stateful inspection table in the CLI. Shows proto type, proto number, connection
timeout, source & destination port number, Firewall rule ID, web filter ID, App filter ID, Interface and zone
details, source & destination MAC details.

Page 22 of 130
Module 2 – Network Protection

Troubleshooting Rules and Policies

Verifying firewall rules in the /log/firewall_rule.log
2019-09-05 02:53:16: Firewall - Firewall has 4 rules configured for
ipfamily:0. First rule details => id: 3, name: DNAT, type: 1,
schedule: , Active: 1 . Last rule details => id: 5, name:
#Default_Network_Policy, type: 1, schedule: , Active: 1. Total
iptables chains: 0
2019-09-05 02:53:17: Firewall - fw_add_update: execute cmd 0:
/usr/bin/firewall --update --action ACCEPT --family 0 --position 4 -
-id 5 --src-zone 1 --dst-zone 2 --src-network 0 --dst-network 0 --
service 0 --state ON --dscp-mark -1 --policy-type 1
2019-09-05 02:53:17: Firewall - makebwpolicy event is UPDATE
2019-09-05 02:53:18: Firewall - Firewall has 4 rules configured for
ipfamily:0. First rule details => id: 3, name: DNAT, type: 1,
schedule: , Active: 1 . Last rule details => id: 5, name:
#Default_Network_Policy, type: 1, schedule: , Active: 1. Total
iptables chains: 0

Troubleshooting Rules and Policies

Verifying firewall rules in the firewall_rule.log
When troubleshooting firewall rule related issues, firewall_rule.log file should be checked.
We will be getting multiple events like ADD, DELETE, UPDATE at the the time doing changes for firewall
rules.
Verify the database entries
Database file for exception in firewall rule:
1. Service exception configuration : tblfwservice_exception
psql -U nobody -d corporate -c "select * from tblfwservice_exception"
fwruleid | serviceid
----------+-----------
14 | 5
14 | 6
2. Source exception configuration : tblfwsource_exception
psql -U nobody -d corporate -c "select * from tblfwsource_exception"
fwruleid | hostid
----------+--------
14 | 9

Page 23 of 130
Module 2 – Network Protection

The above ID in fwruleid and Hostid can be check from IPSET

Page 24 of 130
Module 2 – Network Protection

Troubleshooting Rules and Policies

Displays all configured firewall rule
# firewall --list
ID: 5
Family: IPv4
Position: 5
Action: ACCEPT
State: ON
Policy type: 1
Web filter ID: 0
App filter ID: 0
DSCP Mark: -1
IPS ID: 0
Source Heartbeat: OFF
Destination Heartbeat: OFF
....

# firewall --save
--id 5 --position 5 --family 0 --action ACCEPT --state ON --policy-type 1 --web-filter-id
0 --app-filter-id 0 --dscp-mark -1 --ips-id 0 --src-hb OFF --dst-hb OFF --src-zone 1 --
dst-zone 2 --src-network 0 --dst-network 0 --service 0
--id 6 --position 2 --family 0 --action ACCEPT --state ON --policy-type 1 --web-filter-id
0 --app-filter-id 0 --dscp-mark -1 --ips-id 0 --src-hb OFF --dst-hb OFF --src-zone 1 --
dst-zone 2 --src-network 372 --dst-network 373 --service 0 --log-firewall

Troubleshooting Rules and Policies

Displays all configured firewall rule
The command “firewall --list” displays all configured firewall rule on device which will be having ID assign
to every configuration that can be check from database
# firewall --list
ID: 5
Family: IPv4
Position: 5
Action: ACCEPT
State: ON
Policy type: 1
Web filter ID: 0
App filter ID: 0
DSCP Mark: -1
IPS ID: 0
Source Heartbeat: OFF
Destination Heartbeat: OFF
Source Zone: 1

Page 25 of 130
Module 2 – Network Protection

Destination Zone: 2
Blocked Source Zone: None
Blocked Destination Zone: None
Source network: Any
Destination network: Any
Blocked source network: None
Blocked destination network: None
Service: Any
Destination Ports: Any
The command “firewall –save” helps us to get more details about firewall rule which shows set of
parameter which are linked with IPSET.
For example :- If --dst-zone 2 that means if we check this ID with IPSET then it will show respective Zone
with ID marked as 2
EAP3# psql -U nobody -d corporate -c "select * from tblnetworkzone where zoneid=2"
zoneid | zonename | zonetype | description | system_zone | displaystatus | moveable
--------+----------+----------+-------------+-------------+---------------+----------
2 | WAN | 2| | 1| 1| 1
(1 row)
Verify the firewall chain with iptables
We have single template for a firewall chain in IPTABLES i.e. FIREWALL.
Earlier, in v17 we use to have multiple iptables chains for every firewall rule which was causing multiple
issue at the time of update/delete/add of firewall rule.
v17 Firewall chain
Chain fw1_mark_mpre (1 references)
target prot opt source destination optimization
ENTITY all -- [Link]/0 [Link]/0 skip_ip_match ENTITY TARGET WEBFLT 0 APPFLT
0 FWID 1 MMFLAGS 512 POLICYTYPE 1
HB_SRC_NO_RESTRICTION all -- [Link]/0 [Link]/0 skip_entry
ACCEPT all -- [Link]/0 [Link]/0 skip_ip_match
Chain fw5_mark_mout (2 references)
target prot opt source destination optimization
ENTITY all -- [Link]/0 [Link]/0 skip_ip_match ENTITY TARGET WEBFLT 0 APPFLT
3 FWID 5 CTFLAGS 33555466 SCANFLAGS 72 MMFLAGS 512 POLICYTYPE 1
Chain fw6_mark_mout (2 references)
target prot opt source destination optimization

Page 26 of 130
Module 2 – Network Protection

ENTITY all -- [Link]/0 [Link]/0 skip_ip_match ENTITY TARGET WEBFLT 0 APPFLT

0 FWID 6 CTFLAGS 33554432 MMFLAGS 512 POLICYTYPE 1
v18 and v19 Single Template firewall chain
iptables -t mangle -nL UPSTREAM_MANGLE_PRE_NP
Chain UPSTREAM_MANGLE_PRE_NP (1 references)
target prot opt source destination optimization
DRPROXIES_PRE all -- [Link]/0 [Link]/0 skip_ip_match
NATLOOKUP all -- [Link]/0 [Link]/0 skip_ip_match state NEW NATLOOKUP --dnat
SFOS_DNAT all -- [Link]/0 [Link]/0 skip_ip_match state NEW ENTITY MATCH ! --
natid 0 SFOS_DNAT --fetch-only
OUTDEV all -- [Link]/0 [Link]/0 skip_ip_match state NEW ENTITY MATCH ! --
natid 0 OUTDEV TARGET by-ct-reply-src
FIREWALL all -- [Link]/0 [Link]/0 skip_ip_match FIREWALL
fw_policyroute all -- [Link]/0 [Link]/0 skip_entry RULEID match ! --fwruleid 0

Page 27 of 130
Module 2 – Network Protection

Network Address Translation (NAT)

Page 28 of 130
Module 2 – Network Protection

Enterprise NAT Implementation

NAT

MASQ/SNAT DNAT Full NAT

Linked NAT Explicit NAT Explicit NAT Explicit NAT

Enterprise NAT Implementation

NAT rules are now decoupled from firewall rules, enabling more powerful and flexible configuration
options, including Source (SNAT) and Destination (DNAT) in a single rule.
We have 2 options while creating NAT for new firewall rule i.e.
o Linked NAT :- This NAT policy matched to that particular firewall rule only.
o Explicit NAT :- This NAT Policy corresponds according to the matching criteria and it can also
relate to the linked firewall rule.
Supported NAT Types
1. SNAT (source NAT)
2. Loopback policy
3. DNAT (destination NAT)
4. Linked NAT policy
5. Reflexive policy
6. NAT load balancing
Here you can see the different types of NAT that Sophos Firewall supports. While it will be easier to
configure many of these in version 18/19 the only new NAT types are the loopback NAT policy and the
one-to-one load balancing for full network NAT.
Note: NAT rule still requires firewall rules to allow traffic

Page 29 of 130
Module 2 – Network Protection

Network Address Translation (NAT)

Enterprise NAT Packet flow matching a DNAT and SNAT rule

Change the Packet

Packet NAT SNAT/Linked
Marking Outzone as Firewall forwarded to
Arrives lookup NAT
per DNAT final resort

1 2 3 4 5 6 7
NAT lookup for Dst. zone will FW rule SNAT or
all rules be changed matching Linked NAT
(excluding as per DNAT would be as per rule
linked NAT) rule. done for would be
post-NAT applied
zone and
pre-NAT IP

Network Address Translation (NAT)

Enterprise NAT Packet flow
When a packet arrives and the marking has been done the Sophos Firewall performs a NAT lookup for
DNAT or Full NAT rules. If a NAT rule has been matched the destination zone is translated before the
packet goes to the firewall. This means that the firewall will be matching rules based on the post-NAT
destination zone and the pre-NAT IP address.
After the firewall either:
• The DNAT or Full NAT rule matched in step 3 is used to do the translation
• A second NAT lookup is done for SNAT rules or linked rules and this translation is applied
Finally, the packet is delivered.
NAT Lookup condition:
[Click]
A DNAT rule is matched in NAT lookup (3)
[Click]
“Out-zone” will be changed (based on the matched rule) (4)
[Click]
The traffic will then flow through the Firewall rule (5)
The will be sent to final destination after translation (translation will be applied based on earlier matched
DNAT rule. (7)

Page 30 of 130
Module 2 – Network Protection

No SNAT or linked NAT rule will be matched (6)

Note: No second lookup (Step #6) in this case.
Case:-2 If DNAT rule is not matched in NAT lookup (#3),
- First (#5), Firewall rule will be traversed
- Second (#6), NAT look up will be performed [second time](#6) – best match NAT rule will be applied
based on configured rule orders (it can be SNAT or Linked NAT rule)
- Last, packet will be sent to final resort (#7).
Note:- MLM is an Multi Link management and OutDev is an Out interface

Troubleshooting NAT
Using conntrack
# conntrack -E | grep [Link]
[NEW] proto=icmp proto-no=1 timeout=30 orig-src=[Link] orig-
dst=[Link] type=8 code=0 id=1 [UNREPLIED] reply-src=[Link] reply-
dst=[Link] type=0 code=0 id=1 mark=0x8001 id=25578944 masterid=0
devin=Port1 devout=Port2 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0
icapid=0 policytype=1 fwid=5 natid=2 fw_action=1 bwid=0 appid=0
appcatid=0 hbappid=0 hbappcatid=0 dpioffload=0x1 inzone=1 outzone=2
devinindex=5 devoutindex=6 hb_src=0 hb_dst=0 flags0=0x800a8000200000
flags1=0x800000 flagvalues=21,39,41,43,55,87 catid=0 user=0 luserid=0
usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=00:0c:29:04:ee:a0
src_mac=00:0c:29:f5:fa:4c startstamp=1567211027 microflow[0]=INVALID
microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0
loindex=6 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0
current_state[0]=5 current_state[1]=0 vlan_id=0 inmark=0x0 brinindex=0
sessionid=92 sessionidrev=19168 session_update_rev=1 dnat_done=0
upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=65535
nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED

Troubleshooting NAT
Using conntrack
If we look at an example, conntrack entries for the relevant connection is mark natid as 2.
This commands shows Stateful inspection table in the CLI. Shows proto type, proto number, connection
timeout, source & destination port number, Firewall rule ID, web filter ID, App filter ID, Interface and zone
details, source & destination MAC details.

Page 31 of 130
Module 2 – Network Protection

Troubleshooting NAT
Verify NAT settings in the nat_rule.log
2019-09-09 14:11:18: NAT - executing cmd : nat add --id 5 --position
3 --state 1 --family 0 --masq --dst-vhost-type 0 --translated-dst
372 --translated-service 49 --original-dst 370 --original-service 63
--out-interface Port2
2019-09-09 14:11:20: NAT - executing cmd : nat add --id 4 --position
4 --state 1 --family 0 --translated-src 376 --dst-vhost-type 0 --
override_out_interface Port1 --override_translated_src 373 --
override_is_masquerade 0
2019-09-09 17:23:09: NAT - executing cmd : nat add --id 7 --position
1 --state 1 --family 0 --masq --dst-vhost-type 0
2019-09-09 17:23:22: NAT - executing cmd : nat delete --id 7 --
family 0

Troubleshooting NAT
Verify NAT settings in the nat_rule.log
When troubleshooting firewall rule related issues, nat_rule.log file should be checked
We will be getting multiple events like ADD, DELETE, UPDATE at the the time of changes with all NAT rules.
Verify NAT setting in the configuration database
# psql -U nobody -d corporate -c "select * from tblnatrule" -x;
-[ RECORD 1 ]-------+-----------------------------------------------
id |2
name | #NAT_Default_Network_Policy
description |
isenable |1
translatedsourceid |
translateddestid |
translatedserviceid |
ipfamily |0
position |2
fwruleid |
ismasq |1

Page 32 of 130
Module 2 – Network Protection

ismigrated |0
lbmethod |
monitorindex |
islive |f
createdat | 2019-08-30 23:28:11.954577+05:30
updatedat |
The command psql -U nobody -d corporate -c "select * from tblnatrule" ; will display the NAT attributes
like id, name, description etc.
We have database table enhancement with v18 in which we have below list of new database tables for
NAT

Page 33 of 130
Module 2 – Network Protection

Troubleshooting NAT
Verify NAT setting using nat list
# nat list
[count:0 last-hit:Unused] nat --id 3 --position 1 --state 1 --family
0 --fwid 0 --original-dst 370 --original-service 63 --dst-vhost-type
0 --translated-src 0 --translated-dst 372 --translated-service 49
[count:0 last-hit:Unused] nat --id 6 --position 2 --state 1 --family
0 --fwid 0 --original-src 372 --masq --dst-vhost-type 0 --
translated-src 0 --translated-dst 0 --translated-service 0
[count:0 last-hit:Unused] nat --id 5 --position 3 --state 1 --family
0 --fwid 0 --original-dst 370 --original-service 63 --out-interface
Port2 --masq --dst-vhost-type 0 --translated-src 0 --translated-dst
372 --translated-service 49

Troubleshooting NAT
Verify NAT setting using nat list
The NAT utility can be helpful for troubleshooting NAT related issues
The command "nat list" displays all configured NAT rules in the appliance where it assign an ID to every
configuration tracked in the database.
Verify the IPset for each ID from the nat list output and then match it with our configuration.
Original-dst
# ipset -L | grep HOSTID=370
HOSTID=370,TYPE=ip,IP=[Link]
Translated-dst
# ipset -L | grep HOSTID=372
HOSTID=372,TYPE=ip,IP=[Link]
Original-service
# ipset -L serviceset | grep 63
63,tcpudp,6,1,65535,2000,2000
Translated-service
# ipset -L serviceset | grep 49
49,tcpudp,6,1,65535,23,23

Page 34 of 130
Module 2 – Network Protection

Routing and SD-WAN

Page 35 of 130
Module 2 – Network Protection

PBR: SD-WAN Route

Routing Polices RTG: Route Through Gateway

MLM: Multi Link Management

XGS87_SN01_SFOS 19.0.0 EAP2-Build267# ip ru ls

Probe traffic (v19 GA)
0: from all lookup local
01: from all fwmark 0x1001 lookup gw1
01: from all fwmark 0x1002 lookup gw2
51: from all fwmark 0x4003 lookup gw3 SD-WAN traffic
51: from all fwmark 0x4002 lookup gw2
51: from all fwmark 0x4001 lookup gw1
Static, Dynamic, 53: from all lookup main Route through gateway
Directly connected 54: from all fwmark 0x200 lookup routeipsec0 (v17.5)
networks 150: from all fwmark 0x8003 lookup gw3
150: from all fwmark 0x8002 lookup gw2
150: from all fwmark 0x8001 lookup gw1
220: from all iif lo lookup 220 Default routing
221: from all lookup multilink

Routing Polices
By default, Static routing has the highest priority; this can be viewed on the console, and changed if
necessary using the system route_precedence command.
The commands for managing route precedence are:
system route_precedence show - Display current route precedence
system route_precedence set sdwan_policyroute vpn static - Set new route precedence
Default route precedence:
• Static routes
• SD-WAN policy routes
• VPN routes
Here is an example of the routing table on Sophos Firewall. You can see that it uses a combination of the
source and fwmark to lookup gateways. The table will be followed from top to bottom based on the
routing precedence. The following packet journey is taken.
A few points to note:
[Click]
0: from all lookup local : Match when Sophos Firewall sends traffic to itself
[Click]
01: from all fwmark 0x1001 lookup gw1/gw2 : Probe traffic (This is the traffic generated when we
perform a health check from the WebAdmin)

Page 36 of 130
Module 2 – Network Protection

[Click]
51: from all fwmark 0x4001 lookup gw1/gw2/gw3 : Match SD WAN traffic if marked
[Click]
53: from all lookup main : Static routes including static, dynamic and directly connected networks
[Click]
54: from all fwmark 0x200 lookup routeipsec0 : IPSEC tunnel routes marking
[Click]
150: from all fwmark 0x8002 lookup gw1/gw2/gw3/ : RTG (Route Through Gateway)
[Click]
220: from all iif lo lookup 220 : System generated traffic and IPsec VPN
[Click]
221: from all lookup multilink : Default Routing (Review this)
• Packets are only marked for one of PBR, RTG or MLM
PBR: Policy Based Route
RTG: Route Through Gateway
MLM: Multi Link Management
• If a packet is marked for RTG the XG will still traverse the full route precedence, but will not be able
to match PBR because the fwmark will be different
• RTG will always have a lower precedence than VPN and static

Page 37 of 130
Module 2 – Network Protection

Mark Routing type

Routing Precedence 0 x 1xxx

0 x 4xxx
Probe / Health check traffic

SD-WAN routing (policy routing)

0 x 8xxx Multi link management (WAN link load balancing)*

0 x 8xxx Route through gateway (prior to v18)

0 x 2xx Policy based VPN

DST:E
DST:A DST:C
DST:B Firewall Mark Routing table

0x4001 (GW-1) Destination Next Hop

SD-WAN routes A GW-1 (0x4001)

0x200 (ipsec0) Destination Next Hop

Precedence

VPN routes B ipsec0 (PBVPN)

(GW-2) Destination Next Hop

Static (main) routes A and E GW-2

0x8003 (GW3) Destination Next Hop

Default routes (MLM) default GW-3 (0x8003)

Routing Precedence
On the left, we have manually set the route precedence as SD-WAN routes > VPN routes > Static routes >
Default routes. On the right, We have the routing table linked to the different types of routes.
Let’s see how a packet for a destination flows through the routing precedence.
The packets will travel from the order shown (From SD-WAN to Default route) and identify the appropriate
matching routing table.
• DST A packet travels the same way and finds it’s next hop as we have configured it in the routing
table. Here, we do a marking (0x4001) to influence the default kernel routing.
• DST B packet travels the same way and finds an appropriate route, and a firewall marking (0x200) is
also done.
• Similarly, the DST E packet travels the same way and finds it’s appropriate route.
• Finally, the DST C packet travels through the same precedence, but there’s no route configured in
the routing table for this packet. Since there’s no route configured, the packet will flow through the
default route, which is MLM (Multi-Link Management) in this case and a firewall marking (0x8003)
is done.

Every traffic will have its Firewall mark that defines how the traffic should be routed. For example, The
routing here does not have the information about an application or user. We use a ‘mark identity’, which
finds the gateway for the application and the user. These marking are used to gain a higher level of
routing.

Page 38 of 130
Module 2 – Network Protection

Dynamic and static routing

Log files

Log file Description

/log/[Link] Network Service - Interface/IP/PPPOE

/log/[Link] MLM, VPN failover, Dead Gateway Detect

/log/[Link] - /log/[Link] - /log/[Link], Static and dynamic routing

/log/[Link] - /log/[Link]**

/log/[Link] and /log/[Link] Multi-cast routing and Static Multi-cast Routes

/log/[Link], /log/[Link] and /log/[Link] Generic logs

Dynamic and static routing

Relevant log files
Network service(networkd), MLM, VPN failover, Dead Gateway Detect(dgd), Static and dynamic
routing(ripd,ospfd,bgp,zebra), Multicast routing and Static Multicast Route(mrouting, PIMD), Generic
logs(applog,csc and syslog) are important service log file which will be used for resolving routing related
issue
Note :- Never restart "networkd" service.
The following configuration files are used when troubleshooting Static and Dynamic routing issues
/cfs/system/routing/[Link] - RIP configuration file
/cfs/system/routing/[Link] - OSPF configuration file
/cfs/system/routing/[Link] - BGP configuration file
/cfs/system/routing/[Link] - Static routing configuration file
/cfs/system/dgd/[Link] - Dead Gateway Detect configuration logs

Page 39 of 130
Module 2 – Network Protection

Troubleshooting Dynamic and static routing

ip commands to show neighbors and routes
# ip neighbor show
[Link] dev Port2 lladdr 00:0c:29:f2:89:90 REACHABLE fpindex 65535 fprev 0
[Link] dev Port1 lladdr 88:e9:fe:65:41:59 REACHABLE fpindex 65535 fprev 0
[Link] dev Port3 lladdr 00:0c:29:f5:fa:4c REACHABLE fpindex 65535 fprev 0
[Link] dev Port3 FAILED fpindex 65535 fprev 0

# ip address show
5: Port1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast group 0x01 nfmark 0
nfmark6 0 nettype 0x01 state UNKNOWN group default qlen 1000
inet [Link]/24 brd [Link] scope global Port1
7: Port3: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast group 0x01 nfmark 0 nfmark6 0
nettype 0x01 state DOWN group default qlen 1000
inet [Link]/24 brd [Link] scope global Port3

# ip route show
[Link]/24 dev Port2 proto kernel scope link src [Link]
[Link]/24 dev tun0 proto kernel scope link src [Link]
[Link]/24 dev GuestAP proto kernel scope link src [Link] linkdown
[Link]/24 dev Port3 proto kernel scope link src [Link]
[Link] via [Link] dev tun0
[Link]/24 dev Port1 proto kernel scope link src [Link]

Troubleshooting Dynamic and static routing

ip commands to show neighbors and routes
ip neighbor show :- This command manipulates neighbour objects that establish bindings between
protocol addresses and link layer addresses for hosts sharing the same link. It will list neighbour entries
ip address show :- This command look at protocol addresses, link status, IP address
ip route show :- To print route list
The database table gives us information about settings for interface, MTU, MSS, Zone ID, IP family and
Gateway details
# psql -U nobody -d corporate -c "select * from tblinterface"
interface | enabled | linktype | mtu | mss | interface_speed | overridemac | zoneid | parentinterface
| memberof | name
-----------+---------+----------+------+------+-----------------+-------------------+--------+-----------------+----------+---------
Port1 | 0| 0 | 1500 | 1460 | auto | | 1| | | Port1
Port3 | 0| 0 | 1500 | 1460 | auto | | 1| | | Port3

# psql -U nobody -d corporate -c "select * from tblipaddress"

Page 40 of 130
Module 2 – Network Protection

Port3 | [Link] | [Link] | 0|0 | -1 | 4

Troubleshooting Dynamic and static routing

ip commands to show IPv6 information and interface specific routes
# ip -6 route show
2001:db8::/64 dev tun0 proto kernel metric 256 pref medium
fe80::/64 dev ipsec0 proto kernel metric 256 pref medium
fe80::/64 dev Port1 proto kernel metric 256 pref medium

# ip route get [Link]

[Link] via [Link] dev Port2 table multilink src [Link] uid 0

# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
[Link] [Link] [Link] U 0 0 0 Port2
[Link] [Link] [Link] U 0 0 0 tun0
[Link] [Link] [Link] U 0 0 0
GuestAP
[Link] [Link] [Link] U 0 0 0 Port3
[Link] [Link] [Link] UGH 0 0 0 tun0
[Link] [Link] [Link] U 0 0 0 Port1

Troubleshooting Dynamic and static routing

ip commands to show IPv6 information and interface specific routes
ip -6 route show :- To print IPv6 route list
ip route get [Link]:- One can find out interface for particular destination
route –n :- It show kernel routing table

Page 41 of 130
Module 2 – Network Protection

Configuration files

SFVUNL_HV01_SFOS 19.5.0 EAP1-Build144# ls –l /conf/routing

-rw-r--r-- 1 nobody nobody 78 Oct 18 15:22 [Link]

-rw-r--r-- 1 nobody nobody 81 Oct 18 15:24 [Link]
-rw-r--r-- 1 nobody nobody 80 Oct 18 15:24 [Link]
-rw-r--r-- 1 nobody nobody 87 Oct 18 15:22 [Link]
-rw-r--r-- 1 nobody nobody 83 Oct 18 15:22 [Link]
-rw-r--r-- 1 nobody nobody 82 Oct 18 15:22 [Link]

For saving the configuration, files are used instead of a database for dynamic routing daemons, as it is the
natural method used by FRRouting.
The FRRouting (FRR) engine:
is an open-source routing protocol suite for Unix and Linux platforms.
Here at Sophos, we have integrated this open-source code into the Sophos firewall to provide various
routing protocol capabilities such as BGP, OSPF, IS-IS, and RIP.

FRRouting has been adopted since v19.5 and aims to offer high performance, scalability, and stability
compared to the old QUAGGA engine used in past firmwares like v18+ and v19.0.
All configuration files are located at /conf/routing.

Page 42 of 130
Module 2 – Network Protection

Configure Dynamic routing from CLI

Sophos Firmware Version: SFOS 19.5.0 Sophos Firmware Version: SFOS 19.5.0 Sophos Firmware Version: SFOS 19.5.0
Sophos SFVUNL
Model: Firmware Version: SFOS 19.5.0 Model:
SophosSFVUNL
Firmware Version: SFOS 19.5.0 Model: SFVUNL
Sophos Firmware Version: SFOS 19.5.0
EAP1-Build144
Hostname: v19.5test Hostname:
EAP1-Build144
v19.5test Hostname: v19.5test
EAP1-Build144
Model: SFVUNL Model: SFVUNL Model: SFVUNL
Hostname:
Unicast Routing
v19.5test
Configuration Unicast
Hostname:
Routing
v19.5test
Configuration Unicast Routing
Hostname: Configuration
v19.5test

Main1.
Menu
Configure RIP Router
1. Configure
ManagementRIP 1. Configure
Unicast Routing RIP
Configuration
2. Configure OSPF 2. Configure OSPF 2. Configure OSPF
1. Configure
3. Network Configuration
BGP 3.1. Configure
ConfigureBGPUnicast Routing 3. [Link] BGPRIP
Configure
2. Configure
4. System Configuration
OSPFv3 4.2. Configure
ConfigureOSPFv3
Multicast Routing 4. [Link] OSPFv3
Configure OSPF
0.
3. Exit
Route Configuration 0.0. Exit
Exit 0. [Link]
Configure BGP
4. Device Console 4. Configure OSPFv3
Select MenuManagement
5. Device Number: 2 Select
SelectMenu
MenuNumber:
Number 1[0-2]: Select Menu Number: 3
0. Exit
Trying
6. [Link]...
VPN Management Trying [Link]... Trying [Link]...
Connected to localhost. Device
7. Shutdown/Reboot Connected to localhost. Connected to localhost.
Select Menu Number:
Escape
0. character
Exit is '^]'. Escape character is '^]'. Escape character is '^]'.
ospf> list rip> list bgp> list
Select
show Menu Number [0-7]:
version show version show version
list [permutations] list [permutations] list [permutations]
exit exit exit
quit quit quit
help help help
enable enable enable
terminal length (0-512) terminal length (0-512) terminal length (0-512)
terminal no length terminal no length terminal no length
show commandtree [permutations] show commandtree [permutations] show commandtree [permutations]

Sophos Firewall v19.5 FRR provides support for CLI commands where the dynamic routing protocols can be
configured from the CLI.
Main Menu à Route Configuration à Configure Unicast Routing à Select the respective routing method.

Page 43 of 130
Module 2 – Network Protection

Sophos Firmware Version: SFOS 19.5.0 EAP1-Build144

Debug logs
Model: SFVUNL
Hostname: v19.5test
Unicast Routing Configuration
1. Configure RIP
2. Configure OSPF
3. Configure BGP
4. Configure OSPFv3
0. Exit
Select Menu Number: 2
Trying [Link]...
Connected to localhost.
Escape character is '^]'.
ospf> enable
ospf# debug ospf
(1-65535) Instance ID
bfd Bidirection Forwarding Detection
default-information OSPF default information
event OSPF event information
graceful-restart OSPF Graceful Restart
ism OSPF Interface State Machine
ldp-sync OSPF LDP-Sync information
lsa OSPF Link State Advertisement
nsm OSPF Neighbor State Machine
nssa OSPF nssa information
packet OSPF packets
sr OSPF-SR information
te OSPF-TE information
ti-lfa OSPF-SR TI-LFA information
zebra Zebra information
ospf# debug ospf lsa

ospf# show debugging

OSPF debugging status:
OSPF LSA debugging is on

Above are the debug logs for the respective dynamic routing protocols.
The image at the bottom indicates the configuration files for the dynamic routing protocols.
To enable debug logging, enter ‘debug ospf <type of events>. For example, debug ospf lsa.
To disable debug logging, enter ‘no debug ospf <type of events>. For example, no debug ospf lsa.
To view the debug status, enter show debugging
Upon enabling the debug, you can see the log files under /log directory.
Refer [Link] for more
information on the Debug logs.

Page 44 of 130
Module 2 – Network Protection

IPv6 Integration

Page 45 of 130
Module 2 – Network Protection
Copyright © 2023 Sophos Ltd

IPv6 DHCP Prefix Delegation

DHCP Prefix delegation allows for automatic configuration of IPv6 addresses for IPv6 peers,
ensuring that they have a globally routable IPv6 address delegated by the ISP.

IPv6 Standard Prefixes

/64 LAN1
/64 Smallest prefix – used for individual LANs
/60 Provides 16 individual /64 LANs /60
/64 LAN2
/56 Provides 256 individual /64 LANs

/52 Provides 4096 individual /64 LANs ISP Router

/64 LAN3

/48 Provides 65536 individual /64 LANs /64 LAN..

IPv6 Prefix Delegation (IPv6-PD) is a mechanism that allows an Internet Service Provider (ISP) to assign a
range of IPv6 addresses to a customer's network, enabling the customer to further subdivide and assign
IPv6 addresses within their network.
Overview:
IPv6 Prefix Delegation enables ISPs to allocate a portion of their IPv6 address space to customers
dynamically, empowering them to manage their own subnets efficiently.
Example:
Imagine an ISP allocates the IPv6 prefix 2001:db8:1234::/48 to a residential customer. Using IPv6 Prefix
Delegation, the customer's router can then dynamically request a subset of this prefix, such as
2001:db8:1234:1::/64, for use within their home network. With this delegated prefix, the customer can
then assign unique IPv6 addresses to devices within their network, enabling seamless connectivity to the
broader IPv6 internet

Page 46 of 130
Module 2 – Network Protection
Copyright © 2023 Sophos Ltd

DHCP-PD Deployment

PD Request Port 2 Port 3 PD Distribution

(WAN) (LAN)
Delegated
PD Delegation
Subscribers
Delegating Router SFOS - Requesting Router
(ISP) (CPE)

Many ISPs use DHCP-PD to allocate IPv6 addresses to customer premise devices, and for
allocating IPv6 subnet prefixes for customers' internal networks.

Here is an example network setup with the SFOS.

• Port 3 is the firewall LAN interface connecting to all the clients.
• Port 2 is the WAN interface connecting to an ISP that supports DHCP prefix delegation.
Roles:
Requesting router: The router that acts as a DHCP client and is requesting prefix(es) to be assigned.
Delegating router: The router that acts as a DHCP server, and is responding to the prefix request.
Process:
1. First, the firewall sends a DHCPv6 prefix delegation request to the ISP. In SFOSv20, we now have a
new option to enable DHCP-PD. Optionally, you can specify a preferred prefix or a desired length.
2. Once the ISP receives the request, it will allocate an IPv6 address from the available space and the
firewall will then receive the assigned IPv6 prefix.
3. A new “Delegated” IP assignment mode is selected to receive the ISP’s assigned prefix.
4. The clients connected to the LAN network behind the firewall will receive their IPv6 prefixes
through Router Advertisement (RA) messages.
Configuration: In SFOSv20, a new option allows enabling DHCP-PD on WAN ports. Optionally, you can
specify a preferred prefix or desired length. The downstream SFOS firewall sends a DHCPv6 prefix
delegation request to the ISP from its WAN interface.
Delegation: Upon receiving the request, the ISP allocates an IPv6 address from its available space and
assigns an IPv6 prefix to the firewall.

Page 47 of 130
Module 2 – Network Protection

Distribution: With the allocated prefix, the SFOS configures its LANs and Zones. Every client on the
network then receives IPv6 addresses through Router Advertisement.
To know more about the DHCP Prefix delegation support, refer
[Link]
+DHCP+Prefix+Delegation+Support

Enabling DHCP-PD on WAN Interface

Steps to enable DHCP-PD on WAN Interface:

1. Go to Network -> Interfaces -> Designated WAN Port.
2. Make sure that the selected port network zone is WAN.
3. Enable IPv6 Configuration.
4. Select DHCP in IP Assignment.
5. For Mode, choose the option supported by your ISP and your network deployment. DHCP-PD is
supported for both, Auto and Manual deployment modes.
6. Select DHCP Only for DHCP based auto-configuration or Stateless for Stateless auto-configuration.
7. Turn on DHCP prefix delegation option.
8. Optionally, turn on and set preferred delegated prefix or desired prefix length.
The prefix delegation subnet is required to be specified, however the prefix itself is optional.
9. Set Gateway name
10. Set Gateway IPv6 address.
11. Save to apply.
This process may take some time for the DHCP handshake process to complete.
Page 48 of 130
Module 2 – Network Protection

Verifying DHCP-PD

1. Refresh the page after waiting for some time after saving the DHCP-PD configuration.
2. Click on the Menu option on the right.
3. You will now see a new field “DHCP PD” displaying the leased prefix from the ISP along with the
prefix length.
4. Next, configure the downstream interface connecting to the LAN network.

Page 49 of 130
Module 2 – Network Protection

Configuring the LAN Interface for DHCP-PD

If you turn it on, the

firewall automatically acts
as a router advertisement
server for this interface.

Steps to configure the LAN Interface:

1. Go to Network -> Interfaces -> Designated LAN Port.
2. Make sure that the selected port network zone is LAN.
3. Enable IPv6 Configuration.
4. Under IP assignment, select Delegated.
5. For Upstream Interface, choose the interface on which the delegated prefix was received, the WAN
interface.
6. Once selected, the IPv6 address will be auto populated. The Subnet ID and the Interface ID will be
auto-assigned and can be changed if required. Note: The prefix length for the downstream is fixed
as /64
7. Turn on Router Advertisement (RA) feature.
8. Save the configuration.
To know more about RA, refer [Link]
us/webhelp/onlinehelp/AdministratorHelp/Network/IPv6RouterAdvertisement/[Link]

Page 50 of 130
Module 2 – Network Protection
Copyright © 2023 Sophos Ltd

Verify the RA Server

1. Go to Network -> IPv6 router advertisement tab to verify the RA server.

2. Click on the Port to view more details.
3. Confirm that it is the same prefix and lifetime that was received from the ISP.
4. Next, head over to the client (end device) to configure it to receive IPv6 RA messages.
5. On Windows PC, go to command prompt and type ipconfig to verify the IPv6 address.
6. If the IPv6 address is still not displayed, then check if “Internet Protocol version 6 (TCP/IP) checkbox
is activated for the network adapter in the windows computer.
NOTE: The client combines the received prefix with an interface identifier to complete the IPv6 address.
This identifier is typically derived from the address of the network interface using the EUI-64 format.

Page 51 of 130
Module 2 – Network Protection

IPv6 Prefix Delegation in Log Viewer

To view IPv6 prefix delegation events in log viewer:

1. Go to Log Viewer.
2. Filter by System Events.

Page 52 of 130
Module 2 – Network Protection

DHCPv6 Solicit packet with Option 25 indicating desire to use of Prefix Delegation

The Wireshark capture shows that the DHCPv6 Solicit packet sent by client includes option 25 (Identity
Association for Prefix Delegation) which tells the Delegating router that we want to use prefix delegation.

DHCPv6 Solicit packet with Option 25 and Option 26 indicating a preferred delegated
prefix and prefix length

The Wireshark capture shows that the DHCPv6 Solicit packet includes option 25 along with option 26 (IA
Prefix) which tells the Delegating router that we want prefix address 2a01:db8:: and prefix length 56.

Page 53 of 130
Module 2 – Network Protection

DHCPv6 Solicit packet with Option 25 and Option 26 indicating a preferred prefix length
but no preferred address

The Wireshark capture shows that the DHCPv6 Solicit packet includes option 25 along with option 26 (IA
Prefix) which tells the Delegating router that we want prefix of length 56 (with no preferred address).

DHCPv6 Advertise packet from server to client

Page 54 of 130
Module 2 – Network Protection

DHCPv6 Request packet from client to server

DHCPv6 Reply packet from server to client

Page 55 of 130
Module 2 – Network Protection

Troubleshooting
/log/[Link]
• Search for the word “prefix” if a prefix was chosen
/log/[Link]
Packet captures for ports 546 and port 547
required for diagnosing delegations
Jul 21 11:42:33Z Received system event is prefixup for interface Interface=Port2,IPfamily
= 1, action = BOUND6 Delegated Prefix = 2a01:db8:1:3000::, Prefix netmask = 56, Preferred
Lifetime = 310,Valid Lifetime = 315, Old Delegated Prefix = , Old Prefix netmask =
Jul 21 11:42:33Z dyniface:systemevent_handler Calling prefixup event for Prefix
2a01:db8:1:3000::/56
Jul 21 11:42:33Z dyniface:systemevent_handler Updating Port2 prefix and netmask in DB to
2a01:db8:1:3000:: and 56 respectively on prefixup event. Updating Prefix Valid lifetime to
315 and Prefix Preferred lifetime to 310
Jul 21 11:42:33Z dyniface:systemevent_handler Successfully updated prefix in DB.
Jul 21 11:42:33Z dyniface:systemevent_handler Dynamic Interface Port2 prefixup Event
Completed Successfully.

[Link]
• Log activity when Prefix Delegation is enabled on Upstream Interface.

Jul 21 11:42:33Z Received system event is prefixup for interface Interface=Port2, IPfamily = 1, action =
BOUND6
Delegated Prefix = 2a01:db8:1:3000::, Prefix netmask = 56, Preferred Lifetime = 310, Valid Lifetime = 315,
Old Delegated Prefix = , Old Prefix netmask =
Jul 21 11:42:33Z dyniface:systemevent_handler Calling prefixup event for Prefix 2a01:db8:1:3000::/56
Jul 21 11:42:33Z dyniface:systemevent_handler Updating Port2 prefix and netmask in DB to 2a01:db8:1:3000::
and 56 respectively on prefixup event.
Updating Prefix Valid lifetime to 315 and Prefix Preferred lifetime to 310
Jul 21 11:42:33Z dyniface:systemevent_handler Successfully updated prefix in DB.
Jul 21 11:42:33Z dyniface:systemevent_handler Dynamic Interface Port2 prefixup Event Completed Successfully.

Page 56 of 130
Module 2 – Network Protection

[Link]
• Log activity on Downstream interface, when the upstream interface already has Prefix
Delegated to it.

Jul 21 12:18:23Z edit_interface: For IPAssignment type Delegated, generate IPv6 address
Jul 21 12:18:23Z gen_downstream_addr: Called with upstream_iface=Port2, downstream_iface=Port3,
downstream_suffix=::0:0:0:0:1
Jul 21 12:18:23Z add_prefix_tosubnet: Called with parameters upstream_prefix=2a01:db8:1:3000::,
upstream_prefix_nm=56 and downstream_suffix=::0:0:0:0:1
Jul 21 12:18:24Z add_prefix_tosubnet: IPv6 address 2a01:db8:1:3000::1 generated for Downstream interface Port3
...
Jul 21 12:18:30Z interface_notifier: opcode radvd_server_on_delegated For PHYSICAL Interface and Post Edit
Interface.
Jul 21 12:18:30Z radvd_server_on_delegated: Interface= Port3
Jul 21 12:18:30Z radvd_server_on_delegated: Add RADVD server on delegated interface
...
Jul 21 12:18:31Z Router Advertisement created successfully.

RADVD, which stands for Router Advertisement Daemon, is an open-source software application used for
IPv6 network autoconfiguration. It plays a key role in IPv6 network setup by advertising the network's IPv6
routing information, prefixes, and other configuration details to client devices on the network. RADVD
operates by sending Router Advertisement (RA) messages periodically to notify devices of the available
IPv6 configuration parameters.
Here's how RADVD works:
1. Router Advertisement (RA): RADVD runs on a router within an IPv6 network. It periodically sends
Router Advertisement (RA) messages to the local network segment. These RA messages contain
vital information about the network, including the IPv6 prefixes, the default gateway, and other
network configuration details.
2. Client Configuration: Devices within the network receive these RA messages. When a device
receives an RA message, it can automatically configure its IPv6 address, set the default gateway,
and configure other network parameters without manual configuration.
3. Efficient Network Setup: RADVD simplifies and automates the process of setting up IPv6 networks.
It is particularly helpful in environments where dynamic IPv6 address allocation is used, and it
ensures that devices can communicate on the network without extensive manual configuration.
RADVD is commonly used in Linux-based routers and is available as an open-source software package for a
variety of platforms. It is a crucial component for enabling IPv6 autoconfiguration in many networks.

Page 57 of 130
Module 2 – Network Protection
Copyright © 2023 Sophos Ltd

Scenario: ISP changes the prefix

In SFOSv20, any ISP prefix changes are automatically distributed to all connected
clients.
In real world scenario, prefix changes will not be immediate as ISP’s use a very long
lease time.
Clients may continue to use their old IPv6 address until the preferred/valid lifetime
expires, after this they will switch to their new addresses.

• In SFOSv20, any ISP prefix changes are automatically distributed to all connected clients.
• In real world scenario, prefix changes will not be immediate as ISP’s use a very long lease time.
• Clients may continue to use their old IPv6 address until the preferred/valid lifetime expires, after
this they will switch to their new addresses.
Relevant postgres table:
psql –d corporate –U nobody –c “select * from tbldhcpv6clientconf” –x
• tbldhcpv6clientconf - table showing the prefix delegation for interfaces
• tbldelegatedconf - table related to router delegation of the prefix for internal/downstream
interfaces.
• tblraclientconf - table related to the router advertisement server(RA server) configuration.

Page 58 of 130
Module 2 – Network Protection

IPv6 DHCP-PD Important Notes

PD over PPPoE is not supported, firewall does not support PPPoE over IPv6.

Prefix lengths supported include /48, 52, 56, 60. If prefix length is not supported, the downstream interface
will not be configured.

To troubleshoot prefix length issues, analyze the “[Link]” file and search for “prefix”.

Prefix length for downstream interface fixed at /64.

Prefix of auto-created RA server cannot be modified. If needed, manually create RA server and configure to
advertise desired prefix.

Firewall does not support DHCPv6 server on downstream interface.

• Prefix Delegation over PPPoE is currently not supported by the firewall and the firewall also does
not support PPPoE over IPv6.
• Supported prefix lengths include /48, 52, 56, 60. If the prefix length is not supported, the
downstream interface will not be configured.
• To troubleshoot prefix length issues, analyze the [Link] file and search for the keyword ‘prefix’.
• The prefix length for downstream interface fixed at /64.
• The prefix assigned to the auto-created RA server cannot be modified. If you wish to advertise an
additional prefix, you can manually create an RA server and configure it to advertise the prefix of
choice.
• The firewall currently does not support the implementation of a DHCPv6 server on the downstream
interface.

Page 59 of 130
Module 2 – Network Protection

IPv6 DHCP-PD Important Notes

Upstream interface can request a single prefix

There could be more than one Upstream interfaces in a device

One Upstream interfaces can have multiple Downstream interfaces

Subnet id should be added to the leased prefix on Upstream interface to create a /64
prefix for the downstream interface

RA server should advertise downstream interface's /64 prefix

• Upstream interface can request a single prefix

• There could be more than one Upstream interfaces in a device
• One Upstream interfaces can have multiple Downstream interfaces
• Subnet id should be added to the leased prefix on Upstream interface to create a /64 prefix for the
downstream interface
• RA server should advertise downstream interface's /64 prefix

Page 60 of 130
Module 2 – Network Protection

Troubleshooting
SD-WAN Policy Routing

Page 61 of 130
Module 2 – Network Protection

SD-WAN Policy Routing

Updating, adding and deleting policy routes on A policy route lookup is now performed for
the backend is approximately 9 times faster reply packets

Policy routes work for system originated traffic Application routing

When the primary gateway for a policy route is

Supports TCP, UDP and ICMP deleted the route will also be deleted and the
traffic will get WAN link load balanced

SD-WAN Policy Routing

SD-WAN stands for software defined networking in a wide area network, and is fundamentally about
achieving one or more of the these four objectives:
• Reducing connectivity costs: Traditional MPLS connections are expensive and organizations are
shifting to multiple more affordable broadband WAN options
• Business continuity: Organizations require solutions that will elegantly handle WAN failures and
outages and are looking for redundancy, routing, failover, and session preservation
• Simpler branch office VPN orchestration: VPN orchestration between locations is often complex
and time consuming, so organizations are looking for tools to simplify and automate deployment
and setup
• Quality of critical applications: Organizations are seeking realtime visibility into application traffic
and performance in order to maintain session quality of mission-critical business apps
When considering an SD-WAN solution, it’s very important to understand and prioritize your desired goals
and objectives before diving into any particular solutions or features.
• Updating, adding and deleting policy routes on the backend is approximately 9 times faster. This
makes a significant difference where there are a large number of policy routes.
• Sophos Firewall now performs policy route lookups for reply packets. This allows MPLS scenarios to
work where the MPLS gateway is a zone other than the WAN zone.
• Policy routes now also work for system originated traffic, that is traffic generated by the Sophos
Firewall. and the proxy traffic matches the reply path.
• Application routing over preferred links via SD-WAN policy-based routing.

Page 62 of 130
Module 2 – Network Protection

• Policy routes support TCP, UDP and ICMP.

• When the primary gateway of a policy route is deleted, the policy route will also be deleted and
traffic will get WAN link load balanced, this is the default behaviour for routing traffic when no
policy exists.

Page 63 of 130
Module 2 – Network Protection

SD-WAN Policy Route

Scenario

Office A Office B
N IPsec VPN WA
WA N
Sophos Firewall A Sophos Firewall B

Failover

D MZ D MZ

MPLS
Server
Client Sophos Firewall applies policy Sophos Firewall applies policy
route to send the traffic over the route to the reply traffic to send
preferred link it over the preferred link

SD-WAN Policy Route scenario: Let’s consider a scenario where there are two links between Office A and
Office B. For this example we will use an IPsec VPN which uses the WAN link and an MPLS connection that
is connected to the Sophos Firewall s in the DMZ zone, however these could be other types of link.
Previously, when the Client in Office A connected to the Server in Office B, Sophos Firewall A would apply
the policy route to send the traffic over the preferred link, the MPLS link in this scenario. Sophos Firewall B
however, would not apply the policy route to the reply traffic, so it would route via the WAN zone. This is
why in version 17 of Sophos Firewall this scenario only worked if the MPLS link was attached to an
interface in the WAN zone.
From version 18 and above, Sophos Firewall B will apply policy routing decisions to the reply traffic, which
means it will be routed via the MPLS even if it is not in the WAN zone, such as in this example where it is in
the DMZ.
Customers can enable the feature with the console command ‘set routing sd-wan-policy-route reply-
packet enable’ set routing sd-wan-policy-route system-generate-traffic enable
Note the Policy route to SD-Wan Policy Route migration behaviour:
• Sophos Firewall automatically prefixes the firewall rule ID to the policy route name
• Sophos Firewall uses the firewall rule ID to match traffic with migrated routes
• SD-WAN policy routes have no zone-based settings
• The sequence of migrated policy routes is corresponding to the firewall rule sequence and cannot
be changed
• If a firewall rule is deleted, the migrated policy route is deleted as well
• Only the gateways and the gateway monitoring decisions can be changed in a migrated policy
route.

Page 64 of 130
Module 2 – Network Protection

SD-WAN
Best quality SLA
• Can select >2 links, including
custom gw & RBVPN gw

• Best quality SLA strategy –

o SFOS selects best link based on
selected SLA parameter
o SLA based on Latency/ Jitter/ Packet
Loss

• Granular health check options

with multiple probe targets

SD-WAN Best quality SLA

We have a new tab for SD-WAN profile under Configure --> Routing.
As seen in the previous slide, we can select more than two links/gateways (up to 8). In this scenario, the
traffic checks the assigned gateways in the order that is set and steers the traffic through the first available
link.
The SLA routes the traffic over the best-performing link based on the condition set under "Best quality".
The custom SLA allows us to define the maximum Latency, Jitter and Packet loss permitted.
The Health check allows us to test if a packet takes the correct gateway/link as per the setting.

Page 65 of 130
Module 2 – Network Protection

SD-WAN
Custom SLA configuration
• Admin can configure maximum
allowed disruptions
• Links satisfying configured SLA will be
selected
• Recommendation on SLA values for
commonly used Applications
• Separate SLA values based on Latency/
Jitter/ Packet Loss

SD-WAN – Custom SLA configuration

The custom SLA allows the administrator to define the maximum Latency, Jitter and Packet loss permitted.
Use case: Business-critical application can use custom quality to choose between ISP links. Example, SIP
apps should have loss less than 1%. In that case, SD-WAN profile can be configured with loss set to 1% and
jitter and latency off.

Page 66 of 130
Module 2 – Network Protection

SD-WAN profiles
Summary of the SLAs
• All details in a single view

SD-WAN profiles – Summary of the SLAs

Upon configuration of the SD-WAN profile, we can see the status of it by hovering the mouse over the
status icon of each profile. Giving a summary of the details chosen, in this image we are monitoring latency
SLAs.

Page 67 of 130
Module 2 – Network Protection

SLA Behaviour - No Gateway Meets SLA

SLA not met

Link 1
SLA not met Internal
Link 2
Internet SLA not met
network
Link 3

Q) What if none of the gateways qualifies the SLA criteria?

A) Traffic will be routed as per routing strategy

i.e., First available gateway

SLA Behaviour
• If no Gateways meet the SLA, the traffic will be routed using the first available gateway.

Page 68 of 130
Module 2 – Network Protection

How is link performance calculated

First SLA verdict (after 5s) 2nd SLA verdict (after 10s) 3rd SLA verdict (after 15s)
(L: 150ms, J:50ms, L: 20%) (L: 1000ms, J:500ms, L: 80%) (L: 150ms, J:50ms, L: 0%)

Interva
l
1s

Uniform probe train

Sample size for SLA = 5 Health check declares Health check declares
(sliding window) link Down link Up
Link added to the profile Failures before deactivation = 2 Responses for activation = 2

• Latency, Jitter and Loss are calculated based on last x probes (default 30). Range 5 to 100.
• Time it takes to report first verdict (profile configured/updated/link resorted) = sample count x interval

How is link performance calculated?

Page 69 of 130
Module 2 – Network Protection

Health Check
Gateway Health Check SD-WAN Profile Health Check

Gateway health check: SD-WAN profile health check:

• Used by default routing (MLM), RTG • Independent of a gateway health check

• SD-WAN primary and backup • Each profile does independent health checks
or probing for all the selected gateways
• One does not override other’s decision

Health Check
There are two types of Health check.
1. Gateway Health Check: This is used by MLM and RTG.
2. SD-WAN profile health check: This helps us to check the SD-WAN profile status for all the gateways.
We may have multiple profiles created and so all the gateways will be checked and individual
results will be provided for each gateway.

Page 70 of 130
Module 2 – Network Protection

SD-WAN Profile Health Check Behavior

• The firewall uses the first target configured in the health check server list to
perform the health check.
• The second target continues to be used until it becomes unavailable
• If both servers are unavailable, then the health check fails

SD-WAN Profile Health Check Behavior

• The firewall uses the first target configured in the health check server list to perform the health
check. If the first server is unavailable, then the second target is used.
• The second target continues to be used until it becomes unavailable, and then the firewall returns
to the first server, if it is available.
• If both servers are unavailable, then the health check fails (gateway unavailable).

Page 71 of 130
Module 2 – Network Protection

SD-WAN route

Filter for each Rule ID

Serial No column

Improved drag Data usage info Application All management

discoverability information options folded
under drop-down

SD-WAN route
A basic UI Improvement in SD-WAN feature. You can view the data usage in SD-WAN route, view
application information and manage the rule.

Page 72 of 130
Module 2 – Network Protection

SD-WAN Logging
• SD-WAN routing information added in firewall logs – includes SD-WAN rule
id, name, for both request and reply direction

• Separate component for SD-WAN specific logs

• Health check events
• Route change events

SD-WAN Logging
We can see the traffic passing through the desired gateway/link in the Firewall logs under Log Viewer.
We also have a separate option for SD-WAN in the log viewer where we can identify the "Route change
events" and "Health check events”.

Page 73 of 130
Module 2 – Network Protection

SDWAN route position movement

Earlier version of firewall had the option to move a route to a different position using the drag and drop
feature however it will be difficult when there are too many routes.
With v20, it is now possible to move the route to any position. To move, click on the ‘More’ icon to the
right of the rule and enter the position number to which you want the route to be moved to. For example,
if you want to move the route to the first position, then type 1.
More flexibility to configure the SDWAN rule.
1. Option to move SDWAN route to nth position
2. Option to create SDWAN route at top or bottom.
3. Option to clone SDWAN route above or below the specific route.
4. Option to add SDWAN route above or below the specific route

Page 74 of 130
Module 2 – Network Protection

SDWAN gateway limit increase

• v19.5 limit set for 1024 gateways max.

• New v20 gateway configuration limit:

o DT1 appliances – 64 (XGS87/w, XGS107/w)
o 1UL appliances - 2048
o 2U appliances - 3072
o All other appliances – 1024 (Virtual, Custom HW, all XG devices, XGS116/w, XGS126/w, XGS136w)

With the v19.5, we have a limit of 1024 gateway which is insufficient for the SDWAN deployments built
upon higher-end appliances like 2U or 1UL.
With v20, we have a new gateway configuration limit.
New gateway configuration limit:
1. DT1 appliances - 64
2. 1UL appliances - 2048
3. 2U appliances - 3072
4. All other appliances – 1024
For more information, refer:
[Link]
+and+GW+limit+increase

Page 75 of 130
Module 2 – Network Protection

Zero Impact Failover

Zero-impact failover is triggered on:

SD-WAN route, SLA SD-WAN route Route precedence

changes, Gateway Add/Edit/Delete changes
Up/Down/Quality

Zero-Impact failover is only supported for NO NAT deployment.

Zero Impact Failover

When does this zero-impact failover take place? (When will the firewall route the traffic through the
second link?)
• If there’s an SLA change
• Gateway status goes up/down
• Quality changes (Change in Latency, Jitter or packet loss)
• Modification of SD-WAN routes / adding or removing.
• Change in Route precedence
NOTE: Since the source and destination IP addresses would change (the other computer would not be able
to associate the request with the same connection), Zero-impact failover is only supported for NO NAT
deployment which means the NATTed traffic will not failover to link 2.

Page 76 of 130
Module 2 – Network Protection

Enabling Zero Impact

console> show routing reroute-connection
Reroute status of live connections: on

console> set routing reroute-connection <enable/disable>

console> show routing reroute-snat-connection

Reroute status of live SNAT (source NAT) connections: off

console> set routing reroute-snat-connection <enable/disable>

Enabling Zero Impact

To verify if zero impact failover or rerouting is enabled it can be viewed by the following console
commands and be enabled/disabled accordingly.
If this is disabled, upon gateway/SD-WAN failover the old conntrack table entry is disabled hence a
connection must be re-established.
The second command in reference to SNAT connections is applicable where a same NAT pool is being used
for multiple SD WAN gateway interfaces. Provided that the same source IP can be used on each interface,
it is possible to take advantage of zero impact failover. This will allow the existing conntrack table entry to
be reused.

Page 77 of 130
Module 2 – Network Protection

Troubleshooting SD-WAN Policy Routing

Tracing connection - Using conntrack
# conntrack -L | grep [Link]
proto=icmp proto-no=1 timeout=29 orig-src=[Link] orig-
dst=[Link] type=8 code=0 id=1 packets=8 bytes=480 [UNREPLIED] reply-
src=[Link] reply-dst=[Link] type=0 code=0 id=1 packets=0
bytes=0 mark=0x4003 use=2 id=1957324672 masterid=0 devin=Port1
devout=Port3 nseid=0 ips=0 sslvpnid=0 webfltid=0 appfltid=0 icapid=0
policytype=1 fwid=6 natid=0 fw_action=1 bwid=0 appid=0 appcatid=0
hbappid=0 hbappcatid=0 dpioffload=0x1 inzone=1 outzone=3 devinindex=5
devoutindex=7 hb_src=0 hb_dst=0 flags0=0x400a0000200000 flags1=0x800000
flagvalues=21,41,43,54,87 catid=0 user=6 luserid=1 usergp=1
hotspotuserid=0 hotspotid=0 dst_mac=00:0c:29:3f:74:7d
src_mac=00:0c:29:b3:e3:65 startstamp=1566863589 microflow[0]=INVALID
microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0 diffserv=0
loindex=7 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0
current_state[0]=122 current_state[1]=0 vlan_id=0 inmark=0x0 brinindex=0
sessionid=159 sessionidrev=45333 session_update_rev=1 dnat_done=0
upclass=0:0 dnclass=0:0 pbrid_dir0=1 pbrid_dir1=0 nhop_id[0]=65535
nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED

Troubleshooting SD-WAN Policy Routing

Tracing connection 1 - Using conntrack
In this example, we would trace the traffic passing from the SD-WAN policy route and identify the gateway.
The command “conntrack –L | grep [Link]” would give us the output for the Gateway mark ID, i.e.
0x4003 and SD-WAN Policy ID, i.e. pbrid_dir0 & pbrid_dir1
Note: pbrid_dir0’ is for forward/request packet and 'pbrid_dir1' for reply packet.
The connection for ICMP is marked with policy-based routing ID as pbrid_dir0=1 which means it is a
forward/request packet and it has marked gateway policy ID as mark=0x4003 which shows us which
gateway is getting marked for this connection.
In the next slide, we would trace the SD-WAN policy routes information with the help of SD-WAN policy ID,
i.e. pbrid_dir0 & pbrid_dir1, and for Gateway Mark ID, i.e. 0x4003

Page 78 of 130
Module 2 – Network Protection

Troubleshooting SD-WAN Policy Routing

Tracing connection 2 - Verify the iptable
# iptables -nvL policyroute_pre -t mangle
Chain policyroute_pre (1 references)
pkts bytes target prot opt in out source destination
optimization
93947 13M pbrid_1 all -- * * [Link]/0 [Link]/0
skip_ip_match
SD-WAN Policy ID
# iptables -nvL pbrid_1 -t mangle
Chain pbrid_1 (2 references)
pkts bytes target prot opt in out source
destination optimization
2 120 ENTITY all -- * * [Link]/0
[Link]/0 skip_ip_match pbrmark match ! --pbrmark in
interface match --iniface 5 --master hostset --srcid 377 --dstid 378
serviceset --sid 16,... --masterport ENTITY TARGET MMFLAGS 4194304
PBRMARK 0x4003 PBRID 1 PBR Marking

Troubleshooting SD-WAN Policy Routing

Tracing connection 2 - Verify the iptable
iptables -nvL policyroute_pre -t mangle is an IPtable chain which contains all SD-WAN Policy configuration.
[Click]
iptables -nvL pbrid_1 -t mangle is an IPtable chain contains configuration regarding the interface match --
iniface 5 --master hostset --srcid 377 --dstid 378 serviceset --sid 16 for SD-WAN Policy configured as
pbrid_1.
Here, we have an example of SD-WAN Policy information from our previous conntrack output i.e.
pbrid_dir0=1. Here, pbrid_dir0=1 means that pbrid_1 is getting matched for the traffic.
Next, we would compare with conntrack routes table to identify the gateway table.

Page 79 of 130
Module 2 – Network Protection

Troubleshooting SD-WAN Policy Routing

Tracing connection 3 - Verify the routing information
# ip rule ls
0: from all lookup local Comparing Mark to conntrack
51: from all fwmark 0x4001 lookup gw1
51: from all fwmark 0x4002 lookup gw2 routes table
51: from all fwmark 0x4003 lookup gw3
51: from all fwmark 0x4004 lookup gw4
52: from all fwmark 0x200 lookup routeipsec0
53: from all lookup main
150: from all fwmark 0x8001 lookup gw1
150: from all fwmark 0x8002 lookup gw2
150: from all fwmark 0x8003 lookup gw3
150: from all fwmark 0x8004 lookup gw4
151: from [Link] lookup wanlink1
151: from [Link] lookup wanlink2
220: from all iif lo lookup 220
221: from all lookup multilink
32766: from all lookup main
32767: from all lookup default

# ip route ls table gw3 Route information

default via [Link] dev Port3 proto static
prohibit default proto static metric 1

Troubleshooting SD-WAN Policy Routing

Tracing connection 3 - Verify the routing information
As per the previous connection trace, we got the information about the gateway mark ID, i.e. 0x4003, so
now, with the help of the “ip rule ls” command, it shows the information that 0x4003 is for the gw3 table.
Lastly, we executed the “ip route” command to get information regarding gateway table gw3, i.e. gw3 is
for the Port3 Interface.
ip rule manipulates rules in the routing policy database control the route selection algorithm. we will
compare the mark to the conntrack routes table (not to be confused with inmark) to find which route
includes the mark and then we can find the conntrack routing information for this destination, running the
command shows the route for gw3
ip rule ls :- It shows conntrack route tables with the fwmark and lookup
[Click]
ip route ls table gw3 :- It shows route information for the table gw3 i.e. in our example traffic is route via
Port3

Page 80 of 130
Module 2 – Network Protection

Troubleshooting SD-WAN Policy Routing

Traffic between networks connected to internal ports is being routed to the WAN interface
1. Check if an SD-WAN policy route has Destination networks set to Any.
2. If requirement is to retain the generic policy route, create an SD-WAN policy route
with a specific choice for the destination network. Place this route above
the Any policy route.
3. Verify Routing > SD-WAN policy routing and view the route precedence in the box
below the menu
console> system route_precedence show
Routing Precedence:
1. SD-WAN policy routes
2. VPN routes
3. Static routes

console> system route_precedence set static sdwan_policyroute vpn

Troubleshooting SD-WAN Policy Routing

Traffic between networks connected to internal ports is being routed to the WAN interface
If traffic between directly connected networks, such as networks or subnets connected to the LAN or DMZ
ports flows through the WAN interface instead of passing directly to the internal network, do as follows:
1. Check if an SD-WAN policy route has Destination networks set to Any.
Change the setting from Any to a specific choice (example: WAN Host) from the list. Setting it
to Any forces Sophos Firewall to forward internal traffic also to the WAN interface.
2. If you want to retain the above generic policy route, create an SD-WAN policy route with a specific
choice for the destination network. Place this route above the Any policy route.
3. Verify Routing > SD-WAN policy routing and view the route precedence
Static routes include directly connected networks. To allow Sophos Firewall to forward internal network
traffic directly, the route precedence must be static route, then SD-WAN policy route. Change the route
precedence from the command-line console:
Note: The default route precedence in 18.0 is set to static, SD-WAN policy routes, and VPN. When
migrating an earlier version to 18.0, Sophos Firewall retains the route precedence set in the earlier version.
Alternatively, in fresh 18.0 installations, you may have changed the default precedence. This forces your
internal sources to use the WAN gateway for internal destinations and may break the internal traffic flow.
To see the route precedence, go to the command-line interface and use the following command:
console> system route_precedence show

Page 81 of 130
Module 2 – Network Protection

Troubleshooting SD-WAN Policy Routing

Lost access to Sophos Firewall after creating an SD-WAN policy route
If all the following scenarios occurs, then it can result to a lost access of Sophos Firewall
1. Route precedence set to SD-WAN policy route before static route
2. Destination networks set to Any in the newly created SD-WAN policy route for a specific
internal subnet.
3. SD-WAN policy routing turned on for system-generated traffic.
4. SD-WAN policy routing turned on for reply packets.

console> system route_precedence show

Routing Precedence:
1. SD-WAN policy routes
2. VPN routes
3. Static routes
console> show routing sd-wan-policy-route system-generate-traffic
SD-WAN policy route is turned on for system-generated traffic.
console> show routing sd-wan-policy-route reply-packet
SD-WAN policy route is turned on for reply packets.

Troubleshooting SD-WAN Policy Routing

Lost access to Sophos Firewall after creating an SD-WAN policy route
If you lost access to the web admin and SSH consoles of Sophos Firewall, check if all the following scenarios
occurred. To regain access, you need to change any one of the settings.
[Click]
1. Route precedence set to SD-WAN policy route before static route.
To view the route precedence, go to Routing > SD-WAN policy routing and see the box below the menu.
The route precedence must be static route, then SD-WAN policy route. You can change the route
precedence from the command-line console:
Example: console> system route_precedence set static sdwan_policyroute vpn
[Click]
2. Destination networks set to Any in the newly created SD-WAN policy route for a specific internal
subnet. You can change the setting to a specific choice.
[Click]
3. SD-WAN policy routing turned on for system-generated traffic.
Go to the command-line console and use this command: show routing sd-wan-policy-route system-
generate-traffic
You can turn off SD-WAN policy routing for system-generated traffic.
[Click]
4. SD-WAN policy routing turned on for reply packets.
Page 82 of 130
Module 2 – Network Protection

Go to the command-line console and use this command: show routing sd-wan-policy-route reply-packet
You can turn off SD-WAN policy routing for reply packets.
If all these scenarios occur, Sophos Firewall enforces the generic SD-WAN policy route before static routes
and implements it on system-generated traffic and reply packets too. Access to the web admin and SSH
consoles is lost from the internal subnet specified in the policy route. However, access is available from
other subnets.

Page 83 of 130
Module 2 – Network Protection

SD-WAN Troubleshooting – DGD Logs

• Verbose logging is disabled by default for DGD logs.

# ps -w | grep dgd
dgd 928 887 root 26504 23100 S {dgd} csc -L 3 -w -c /_conf/[Link]
dgd 10329 928 root 150m 2972 S dgd -f /cfs/system/dgd/[Link]
grep 10465 9078 root 22928 2800 S grep dgd
# kill -1 <pid of [Link] process>
# touch /var/tmp/debug_dgd Temporary dgd debugging
# rm –rf /var/tmp_debug_dgd
Permanent NOTICE level debugging

SD-WAN Troubleshooting – DGD Logs

To enable the dgd debug logs, use the command ‘kill -1 <pid of dgd-process>’

SFVUNL_VM01_SFOS 19.0.0 GA-Build306# ps -w | grep dgd

dgd 928 887 root 26504 23100 S {dgd} csc -L 3 -w -c /_conf/[Link]
dgd 10329 928 root 150m 2972 S dgd -f /cfs/system/dgd/[Link]
grep 10465 9078 root 22928 2800 S grep dgd
The above result shows the PID of dgd is 10329. So the command to enable Debug logging is kill -1 10329.
Output:
SFVUNL_VM01_SFOS 19.0.0 GA-Build306# grep "Toggling log level" /log/[Link]
MESSAGE Apr 06 19:49:59Z [4797]: Toggling log level to: DEBUG
MESSAGE Apr 06 19:50:34Z [4797]: Toggling log level to: NOTICE
MESSAGE Apr 06 19:56:50Z [11434]: Toggling log level to: INFO
MESSAGE Apr 06 19:57:49Z [11434]: Toggling log level to: DEBUG
MESSAGE Apr 06 19:57:58Z [11434]: Toggling log level to: NOTICE
MESSAGE Apr 06 19:58:16Z [11434]: Toggling log level to: INFO
The log level will change to INFO automatically after a few minutes and so this is a command to enable dgd
debug logging temporarily and does not survive reboots.

Page 84 of 130
Module 2 – Network Protection

To toggle debugging off, the same process can be repeated using the new/same PID
• Permanent Notice level logging:
The command to enable dgd notice level logs is ‘touch /var/tmp/debug_dgd’

1. touch file. + restart DGD will enable NOTICE level

2. To enable DEBUG level, using the kill method is the only option
3. For GES/support, NOTICE level logs are sufficient

To revert permanent Notice debug logs, remove the file using: rm -rf /var/tmp/debug_dgd

Page 85 of 130
Module 2 – Network Protection

Troubleshooting Application based Policy Routing

Log files and services
# service -S | egrep "(ips\b|appcached|redis-appcache|policyroute)"
ips RUNNING
policyroute RUNNING
redis-appcache RUNNING
appcached RUNNING

# ls -lah [Link]
-rw-r--r-- 1 root 0 68.8K Dec 23 14:18 [Link]

# tail -f /log/[Link]
DBG Nov 27 06:29:25 [Worker] event_loop: event on fd 8
DBG Nov 27 06:29:25 [Worker] message_complete_cb: PUT body:
{"appId": 106,"proto": 17,"family":
2,"dst_ip": "[Link]","dst_port": 53}

Troubleshooting Application based Policy Routing

Log files and services
Application based SD-WAN Optimized application routing and path selection to ensure important business
applications are routed over preferred WAN links. We can add user and group application-based traffic
selection criteria to Sophos Firewall ’s SD-WAN routing configuration.
Working of Application routing:
• For the first connection, Sophos Firewall implements an SD-WAN policy route based on the
matching destination port and IP address, protocol, and the inbound interface. If it doesn't find a
matching route, it applies the default route (WAN link load balance).
• The DPI engine identifies the application and caches the classification decision.
- Based on the user's request, another application may take the original application's place within a
single connection. For example, users may go to [Link] first and then start Facebook chat. If the
change occurs after the original application is identified, the DPI engine makes a new classification
decision.
• The new classification decision applies to subsequent connections of the application traffic.
The time to live (TTL) for application session details is 3600 seconds from the start of the session. If
another session doesn't start within this period, the session details are purged. When you restart Sophos
Firewall, the session details of all application objects are purged. Subsequent connections using the
application go through the implementation process listed above.
Web proxy mode doesn't support application-based routing for micro apps. It supports only pattern
applications and Synchronized Security applications. The DPI engine supports application-based routing for
all applications, including micro apps.
Page 86 of 130
Module 2 – Network Protection

In high availability, the cached application-based routing information is synchronized over the dedicated
HA link using multicast IP [Link] on port 4455
Application-based routes require an active Web Protection license and one of the following:
• Application classification is on, which it is by default
• An application filter is applied to the firewall rule
• Or the application is part of the offload signatures and is flowing through snort
appcached service is responsible of forwarding Tuple details from Snort to redis-appache and IPSet for PBR
to identify the application-based connection
redis-appcache service is used as a cache server, keep track of the application IPSet TTL value and if expires
after 3600, then update appcache to remove app from IPSet.
[Link] is a log file provide tuple information details i.e. appId": 106,"proto": 17,"family":
2,"dst_ip": "[Link]","dst_port": 53

Page 87 of 130
Module 2 – Network Protection

Troubleshooting Application based Policy Routing

Verify iptables and ipset
# iptables -t mangle -nvL pbrid_1
Chain pbrid_1 (2 references)
pkts bytes target prot opt
in out source destination optimization
0 0 ENTITY all --
* * [Link]/0 [Link]/0 skip_ip_match pbrmark
match ! --pbrmark appset --appobjid 1 ENTITY TARGET
MMFLAGS 4194304 PBRMARK 0x4004 PBRID 1
# ipset -L appset | more Application Object ID
Name: appset
Type: bitmap:appset
Revision: 0
Header: size 16000
Size in memory: 512064
References: 5 Tuple details
Members:
APPSETID=5,TYPE=app
family:IPv4,proto:tcp,dstip:[Link],dstport:21,srcip:any,srcport:any
APPSETID=6,TYPE=app
family:IPv4,proto:tcp,dstip:[Link],dstport:80,srcip:any,srcport:any

Troubleshooting Application based Policy Routing

Verify iptables and ipset
Application Object ID :- It is Application object configured in ”Routing > SD-WAN Policy routing >
Application Object”
Tuple details :- Application information shared by appcached service to ipset which will be used for the
application based policy routing
In this example , ipset -L appset | more show us information about tuple of an application for which details
are forwarded from Snort to Appcached server and from Appcached server to IPSET.
Verify the database entries
The command psql -U nobody -d corporate -c "select * from tblapplicationobject where id=2” will display
the table view that displays application object and psql -U nobody -d signature -p 5434 -c "select name
from tblapplication where id=197” will display all of the application.
APPSETID=5,TYPE=app
family:IPv4,proto:tcp,dstip:[Link],dstport:21,srcip:any,srcport:any
# psql -U nobody -d corporate -c "select * from tblapplicationobject where id=2"
id | name | sall | appidlist | categoryid | riskid | charid | techid | classid | smartfilter
----+-----------------------+------+-----------+------------+--------+--------+--------+---------+-------------
2 | zip_file_download_app | 0 | 197 |1 |4 | 2,3 | 1 | |
# psql -U nobody -d signature -p 5434 -c "select name from tblapplication where id=197"
name
-------------------
Page 88 of 130
Module 2 – Network Protection

v19.5
SD-WAN Load Balancing

Page 89 of 130
Module 2 – Network Protection

SD-WAN Load Balancing Overview

v20
v19.5
v19.0

What’s new with v19.5?

With the v19, when there are multiple gateways within a SD-WAN profile then only the first available
gateway is used to serve the traffic.
v19.5 Firewall Load balancing feature removes this limitation and allows to serve the traffic through all the
'available' gateways of Profile.
Use case:
The SD-WAN Load balancing can be used for the following scenarios.
• Use all available gateways in the SD-WAN profile, that satisfy profile's SLA and/or health-check
criterion.
• Add the gateways in the SD-WAN profile with traffic weightage
There are multiple ways to load balance the traffic.
1. Round robin fashion
2. Traffic originating from the same source IP to use the same out gateway.
3. Traffic destined to the same destination to use the same out gateway.
4. Traffic coming from same source and going to same destination to be served by same gateway.
5. Same connection to be served by same gateway.

Page 90 of 130
Module 2 – Network Protection

SD-WAN performance

Upon creation of SD-WAN profiles and assigning it to the SD-WAN routes, we can monitor the performance
of each gateway from Diagnostics à SD-WAN performance.

Page 91 of 130
Module 2 – Network Protection

Difference between Available GW and LB

Using
available
Gateway

Using Load
balancing

Difference between Available gateway and Load balancing:

When creating a SDWAN profile with available gateway, the traffic will be served using one of the available
gateways and so you will see a green check in the status column only for one gateway however the load
balancing feature will allow all the gateways to serve the traffic as per the configuration (round-robin, per-
connection, src/dst based) and so we will see a green check mark in all the links.

Page 92 of 130
Module 2 – Network Protection

Load Balance approach and traffic re-routing

When there’s traffic or a new connection, it is processed and is routed through a specific gateway based on
SD-WAN load balancing profile configuration.
[Click]
Dependencies - Re-route feature behavior (Enabled by default)
If one of the gateway is down, the traffic will be re-routed over any of the other available gateways.
To see if the re-route feature is enabled/disabled, Run the following command from the console:
console> show routing reroute-connection
To enable traffic redirection, you can run the following command from the console:
console> set routing reroute-connection <enable/disable>

Page 93 of 130
Module 2 – Network Protection

Routing behavior when a condition is not met

# RTG SLA Health Check Events and Actions

1. OFF OFF OFF Don't care, No Events, All gateways are assumed to be up.

2. OFF OFF ON Load balance as soon as at least one gateways becomes available.

3. OFF ON ON Load balance as soon as at least one gateways becomes available.

4. ON x x If all gateways are down for given profile, ipset is added with first gateway of the profile.

This picture explains the routing behavior when a condition such as SLA/Health check is not met.

Log Viewer entries

Multiple gateways
used for load
balancing

We can see all the logs such as ‘Health check and Route change events’ related to SD-WAN profiles from
the log [Link]
[Link]
WAN+traffic+load+balancing for more information.

Page 94 of 130
Module 2 – Network Protection

Intrusion Prevention System (IPS)

Page 95 of 130
Module 2 – Network Protection

Fine tuning IPS

Packet Streaming
• IPS Packet Streaming is responsible for verifying every TCP stream that
passes thru the firewall by checking for any injected packets

IPS PACKET STREAMING ON

TCP STREAM

Packet 2
WAN Packet 3 Retransmission
Packet 2 Packet 1 LAN
Malicious Code

Fine tuning IPS

Packet Streaming
Sophos Firewall use a modified “SNORT” [open source] engine to achieve desired functionality, inter
process communication and signature matching. This is a common service use IPS, Web & Application
filter.
TALOS IPS signatures and categories which is a new set of IPS categories will provide customers additional
granularity of both categorization and distribution of IPS signatures as well as will bring IPS categorization
in-line with industry standards.
The value for MAXPKTS and stream on/off is different from case to case and depends on:
Deployment type and size
Number of signatures being used
Network traffic being generated
ISP bandwidth
Number of published Servers/Resources, and more…
It buffers the entire Stream of packets inside a TCP session.
Re-Assembles the TCP segments into a correct stream based on the sequence numbers.
Check for Overlapping packets and Duplicate segments and their Checksums.
Scan every packet with the IPS engine to identify the malicious or duplicate payload.
Stateful Inspection is used!
An initial conversation is carried out which is known as the three-way handshake.

Page 96 of 130
Module 2 – Network Protection

Once the connection is set-up, data is transferred. When data transfer is completed, the conversation
ends. The stream module is use in these conversations where IPS builds internal tables to represent these
sessions and tears them down after each session ends.
For example in Telnet session, stream preprocessor will keep on assembling packets until termination
request (0x0d0a0d0a) is received.

TALOS IPS

Enable/Disable IPS IPS License information

TALOS IPS
The IPS signatures will only be on the firewall when Network Protection is subscribed (license) and when
IPS is in use.
Turning off the IPS feature will give us an alert “The firewall removes the IPS signatures if you don’t turn
IPS protection back on within 30 days”.
The behavior of the IPS feature based on the license is explained in the image.
• Evaluation/Paid license – Once enabled, The IPS signatures are downloaded if there’s an active
license. The downloaded signatures will be available as long as the feature remains On.
• Eval license expired -- Displays an alert stating “Can’t turn it on as license expired” when we try
to enable the feature. The downloaded signatures will be deleted after 30 days.
• Paid license expired -- Displays an alert stating “Can’t turn it on as license expired” when we try
to enable the feature. The downloaded signatures will be deleted after 30 days if the feature is
turned of. However, the downloaded signatures will be available if the feature remains On.

Page 97 of 130
Module 2 – Network Protection

Port agnostic IPS for decrypted traffic

• Scan any TCP traffic regardless of port to detect HTTP/HTTPS sessions
• On: This signature will match on plain and decrypted HTTP traffic on any port such
as 8080, 4443, and so on.
• Off: This signature will match plain HTTP traffic on any port/s but will only match
decrypted traffic if the destination port is 80 or 443.
• Enabling the feature may impact performance as it causes false positive detections.
console> set ips scan_decrypted_port_agnostic on/off

Port agnostic IPS for decrypted traffic

Sophos Firewall v19 allow the IPS engine to scan decrypted traffic for signatures on any TCP port regardless
of the specific port the signatures were flagged from is that it allows us to detect HTTP protocol issues
within HTTPS sessions on port 443 or any other port. This is applicable even if the original signature only
specified port 80.
The behavior of the Port agnostic IPS if the feature is on or off:
On: This signature will match on plain and decrypted HTTP traffic on any port such as 8080, 4443, and so
on.
Off: This signature will match plain HTTP traffic on any port/s but will only match decrypted traffic if the
destination port is 80 or 443.
Troubleshooting:
Handling false positive/s or impact on performance after turning on the IPS port agnostic feature
Do any of the following:

• Sophos Support should advise the customer to create an IPS signature exception for the
relevant signature/s.
• Exception of the config path: Edit the relevant policy in Intrusion Prevention > IPS policies,
add the concerned signature on top, and set the action to Allow packet.
• For any false-positive cases, raise the query with SophosLabs via Lab Requests. Adding a
workaround (IPS signature exception) must be followed if the customer agrees or prefers it.
• Contact GES if there are further issues or concerns.

Page 98 of 130
Module 2 – Network Protection

Turn off the port-agnostic inspection of decrypted HTTPS traffic

• Turn off the feature/s via CLI if the false-positive rates are very high or if the customer does
not get convinced.
• There is a potential performance impact of up to 20% reduced throughput for decrypted
HTTPS. If this becomes a problem, the admin may turn off the feature via CLI.
• Sophos Support or GES must only advise this option as a last resort as it will turn off the
extra security benefits provided by the feature. In the vast majority of cases, an IPS
exception will be all that is needed.
• Inspection of decrypted HTTPS traffic should remain turned on (decryption and port-
agnostic inspection can be toggled independently).
• Raise the query with SophosLabs via Lab Requests.
• Contact GES if there are further issues or concerns

Page 99 of 130
Module 2 – Network Protection

Fine tuning IPS

Settings overview in the CLI
console> show ips-settings
-------------IPS Settings-------------
stream on
lowmem off
maxsesbytes 0
maxpkts 8
enable_appsignatures on
http_response_scan_limit 65535
search_method hyperscan
sip_preproc enabled
sip_ignore_call_channel enabled
inspect untrusted-content
-------------IPS Instances------------
IPS CPU
1 0
2 1
3 2
4 3

Fine tuning IPS

Settings overview in the CLI
To verify IPS settings on the appliance, use below command on the console:
console> show ips-settings
set ips ac_atp exception fwrules none :- To bypass a particular firewall rule for Application Classification
and ATP
Stream :- Determines whether packet streaming is allowed or not. Packet streaming is used to restrict
packet surge in situations where the system is experiencing memory issues. If stream is set to on (which is
the default setting), the IPS engine builds an internal table during a session and delete it once session
ends. It also reassembles all incoming packets and checks the data for any known signatures.
lowmem :- LOWMEM settings has its own pros and cons, which affects the appliance memory and
performance. This setting have no effect on how the signature operates. By default this is set to on
(enabled) in low-end appliance where memory is issue and off (disabled) in high-end appliance where
there is abundant memory to handle IPS signatures.

Maxsesbytes :- The maxsesbytes-settings allows you to set the maximum allowed file size to be scanned by
IPS. Any file larger the configured size is bypassed and is not scanned. This value is applied per session.

maxpkts :- Sets the number of packets sent for application classification. By default this is set to 8 but can
be changed to send all packets or any number of packets above 8.

enable_appsignatures :- Turns app-based signatures on or off for IPS. App signatures determine the

Page 100 of 130

Module 2 – Network Protection

application that is using a specific data stream to help ascertain if traffic is malicious or harmless. By
default app-based signatures are enabled.

http_response_scan_limit :- Sets the scan limit for HTTP response packets. Available values are 0-262144,
for full scanning this should be set to 0.
search_method ac-bnfa :- Set the search method to be used for IPS signature pattern matching. ac-bnfa
(low memory usage, high performance) ac-q (high memory usage, best performance) hyperscan (low
memory usage, best performance)
sip_preproc :- Specify if SIP preprocessor is enabled or not. Enabling it will scan all SIP sessions to prevent
any network attacks.
sip_ignore_call_channel :- Set whether the audio and video data channels should be ignored. Enable this
option to ignore such channels
inspect untrusted-content :- Flow will be offloaded to fast path when engine detects that all
IPS/App/Web/AV inspections can be offloaded
Note: with XG version 18 the firewall should automatically run one IPS instance per available core, up to
v17.5 additional instances can be added using a console command.
Similar output is available from ips_conf also:-
console> show ips_conf
config stream 1
config maxsesbytes 0
config stdsig 1
config qnum 10
config maxpkts 8
config disable_tcpopt_experimental_drops 0
config enable_appsignatures 1
var SEARCH_METHOD ac-q
var SIP_STATUS enabled
var IGNORE_CALL_CHANNEL enabled
var TCP_POLICY windows
var LOCAL_RULE [Link]
var DETECT_ANOMALIES no
var TCP_BLOCK nblock
config inspect_content untrusted
config sacmaxpkts 8
config failclose off
config snaplen 1514

Page 101 of 130

Module 2 – Network Protection

Fine tuning IPS

IPS Instance
• IPS can run in multiple instance on multicore appliances
• In multicore cpu appliance keeps multiple instances running to enhance
performance.
• To wipe current CPU allocation and IPS instance:
console> set ips ips-instance add IPS cpu 1
console> show ips-settings
-------------IPS Instances------------
IPS CPU
1 0
2 1
console> set ips ips-instance apply
console> set ips ips-instance clear

Fine Tuning IPS

IPS Instance
IPS Instance is to enhance performance in multicore appliances by running multiple IPS instances. You can
change CPU binding and no of instance as per requirement.
To bind IPS instance with CPU, use below command in the console:
console> set ips ips-instance add IPS cpu <cpu-list>
E.g. in a dual-core appliance cpu 0 an cpu 1 would be available to run IPS instances.
You can add as many entry as many CPU available or as required.
To take the changes into effect, use below command:
console> set ips ips-instance apply
To wipe current core allocation and process, use below command:
console> set ips ips-instance clear

Note: this can still be useful when troubleshooting performance issues related to the IPS engine on v18. On
appliances running v17.5 or older this command should be used to start additional instances per core to
improve performance.

Page 102 of 130

Module 2 – Network Protection

Troubleshooting IPS
Reading the debug [Link]
[Dec 03 15:18:51 :11641]:verdict 0 pktnum 1 flowoff [WEB|AV] appcat
[0:0] dsize 0 [[Link]:55033 -> [Link]:443]
[Dec 03 15:18:51 :11641]:verdict 0 pktnum 1 flowoff [WEB|AV] appcat
[0:0] dsize 0 [[Link]:443 -> [Link]:55033] Modules which
are skippedappcat
[Dec 03 15:18:51 :11641]:verdict 0 pktnum 2 flowoff [WEB|AV]
[0:0] dsize 0 [[Link]:55033 -> [Link]:443]
[Dec 03 15:18:51 :11641]:SetAppid: appid 100 catid 5 sid 1200016
dsize 517 [[Link]:55033 -> [Link]:443]

App ID for this App category

connection ID

[Dec 03 15:18:51 :11641]:verdict 0 pktnum 3 flowoff [WEB|AV] appcat

[100:5] dsize 517 [[Link]:55033 -> [Link]:443]

Final action to
be taken

Troubleshooting IPS
Reading the debug [Link]
[Web|AV] – Web and AV modules are skipped
[Click]
Appid 100 – It is a unique application ID for which information can be verified from database
[Click]
Catid 5 – It is the application category ID of the previously identified Application
what functionalities are being skipped – look for flowoff [IPS|WEB|AV]
if session is offloaded to fast path – look for flowoff [SESSION]
verdict - the action to be taken on the packet after scanning
0 - Allow the packet
1 - Drop the packet
4 - Drop the session
7 - Hold the packet until next verdict (introduced in v18 for WebInSnort)
8 - Offload the session (introduced in v18 for flow offload)
pktnum -# of packet from client/server side
flowoff [ ] -# current state of flow offload, what inspections, if any, are being skipped at the moment
appcat [x:y] – appid x, appcat id y

Page 103 of 130

Module 2 – Network Protection

dsize – data size of packet

The log and service file
# service ips:status -ds nosync
200 RUNNING
# service ips:debug -ds nosync
200 OK
# service -S | grep ips
ips RUNNING,DEBUG
# cd /log
# ls -lah [Link]
-rw-r--r-- 1 root 0 197.3K Nov 20 21:43 [Link]
Verifying database entries
# psql -d corporate -U nobody -c "select * from tblconfiguration where module='ips';"
key | value | module | filename
------------------------------------------+-------------+--------+----------------------
config stream |1 | ips | [Link]
config maxsesbytes |0 | ips | [Link]
config stdsig |1 | ips | [Link]
config qnum | 10 | ips | [Link]
autoupgrade | on | ips | idp_autoupgrade.conf
config maxpkts |8 | ips | [Link]
config disable_tcpopt_experimental_drops | 0 | ips | [Link]
config enable_appsignatures |1 | ips | [Link]
var SEARCH_METHOD | ac-q | ips | [Link]
var SIP_STATUS | enabled | ips | [Link]
var IGNORE_CALL_CHANNEL | enabled | ips | [Link]
var TCP_POLICY | windows | ips | [Link]
var LOCAL_RULE | [Link] | ips | [Link]
var DETECT_ANOMALIES | no | ips | [Link]
var TCP_BLOCK | nblock | ips | [Link]
config inspect_content | untrusted | ips | [Link]
config sacmaxpkts |8 | ips | [Link]
config failclose | off | ips | [Link]
config snaplen | 1514 | ips | [Link]
Page 104 of 130
Module 2 – Network Protection

Using conntrack
You can also get IPS policy no, application ID, application category ID, firewall rule ID by looking at
conntrack table. You should use grep to look at the specific conntrack entries.
proto=tcp proto-no=6 timeout=9 state=TIME_WAIT orig-src=[Link] orig-dst=[Link] orig-
sport=50315 orig-dport=443 packets=42 bytes=2801 reply-src=[Link] reply-dst=[Link] reply-
sport=443 reply-dport=50315 packets=74 bytes=86224 [ASSURED] mark=0x8001 use=1 id=597632896
masterid=0 devin=Port3 devout=Port2 nseid=16778242 ips=5 sslvpnid=0 webfltid=0 appfltid=1 icapid=0
policytype=1 fwid=5 natid=0 fw_action=1 bwid=0 appid=215 appcatid=16 hbappid=0 hbappcatid=0
dpioffload=0xc inzone=1 outzone=2 devinindex=7 devoutindex=6 hb_src=0 hb_dst=0
flags0=0xa0002200008 flags1=0x100810000 flagvalues=3,21,25,41,43,80,87,96 catid=14 user=0 luserid=0
usergp=0 hotspotuserid=0 hotspotid=0 dst_mac=00:0c:29:04:ee:b4 src_mac=00:0c:29:f5:fa:4c
startstamp=1575300455 microflow[0]=INVALID microflow[1]=INVALID hostrev[0]=0 hostrev[1]=0 ipspid=0
diffserv=0 loindex=6 tlsruleid=0 ips_nfqueue=0 sess_verdict=0 gwoff=0 cluster_node=0 current_state[0]=9
current_state[1]=9 vlan_id=0 inmark=0x0 brinindex=0 sessionid=4087 sessionidrev=766
session_update_rev=5 dnat_done=0 upclass=0:0 dnclass=0:0 pbrid_dir0=0 pbrid_dir1=0 nhop_id[0]=65535
nhop_id[1]=65535 nhop_rev[0]=0 nhop_rev[1]=0 conn_fp_id=NOT_OFFLOADED
ips=5 - IPS Policy ID marked for this connection
appid=21 - App ID for this connection
appcatid=16 - App category ID

Page 105 of 130

Module 2 – Network Protection

Silent IPS Signatures

• Sophos Firewall IPS consumes silent signatures released by SophosLabs for
scanning the traffic.
• The telemetry of detections for silent signatures will be sent over SXL4.

Silent IPS Signatures

Telemetry is the information that is used to determine how likely a file is to be a malware.
IPS consumes silent signatures released by Sophos labs for scanning the traffic and the telemetry of
detections for those signatures will be sent over SXL4. The telemetry sent on silent signatures will not alert
or drop the traffic.

Page 106 of 130

Module 2 – Network Protection

Other Network Protection settings and

troubleshooting

Page 107 of 130

Module 2 – Network Protection

Spoof
prevention Packets that have passed the DoS check Spoof No
flowchart Enable?

Yes

MAC in Yes MAC

FOREIGN_HOST Violation No
Trusted Filter
list? Enable?
Yes
No No
IP-MAC
Restrict IP-MAC
pair in Yes
Unknown pair
Trusted
IP Enable? No Enable?
list?
Yes
Yes
No
Same
Src IP not Yes No Yes
reverse IP Spoof
in the IP-
route for Enable?
MAC pair?
IP & Int?
Violation
IP_Spoof

IPMAC_Filter
No Violation Yes No
Drop Traffic Connection Tracking Module

Spoof Prevention Flowchart

Packets that have been passed through DoS module will be submitted to Spoof Prevention module. If
spoof module is not enabled, packets goes to the Connection tracking module and If Spoof module is
configured, UTM first verifies MAC filter configuration.
If MAC filter is enabled, module checks for trusted MAC entries and if no matching MAC found in the list,
packet will be dropped under FOREIGN_HOST violation log component. If matching MAC found in the list,
packet will be checked for IP-MAC pair configuration.
If IP-MAC pair configuration found, module checks IP-MAC pair entries done by an administrator. Upon
negative match, packet further will be checked for the “Restrict Unknown IP” setting. If it is enabled and
there is no matching IP found in the IP-MAC pair, packet will be dropped under IPMAC_Filter violation log
component. If matching entry found for source IP and MAC in the list, packet will be checked for IP
Spoofing.
If IP Spoofing is enabled, module performs route lookup for the source IP and source Interface. If reverse
route is found, packet goes to the connection tracking module but if reverse route not found then packet
will be dropped under IP_Spoof violation log component.

Page 108 of 130

Module 2 – Network Protection

Advanced Firewall Settings

Console commands
console> sh advanced-firewall
Strict Policy : on
FtpBounce Prevention : control
Tcp Conn. Establishment Idle Timeout : 10800
UDP Timeout :
UDP Timeout Stream : 60
Fragmented Traffic Policy : allow
Midstream Connection Pickup : off
TCP Seq Checking : on
TCP Window Scaling : on
TCP Appropriate Byte Count : on
TCP Selective Acknowledgements : on
TCP Forward RTO-Recovery[F-RTO] : off
TCP TIMESTAMPS : off
Strict ICMP Tracking : off
ICMP Error Message : allow
IPv6 Unknown Extension Header : deny

Bypass Stateful Firewall

------------------------
Source Genmask Destination Genmask

NAT policy for system originated traffic

---------------------
Destination Network Destination Netmask Interface SNAT IP

Advanced Firewall Default Settings

Console commands
When packet traverses through an interface, UTM first checks Advanced Firewall settings. If packet is valid
according to the defined settings, its then routed to PREROUTING subsystem of firewall framework.
To check the Advanced Firewall settings go to console (option no. 4) from the main menu and use below
command:
console> sh advanced-firewall
Strict Policy : on
FtpBounce Prevention : control
Tcp Conn. Establishment Idle Timeout : 10800
UDP Timeout :
UDP Timeout Stream : 60
Fragmented Traffic Policy : allow
Midstream Connection Pickup : off
TCP Seq Checking : on
TCP Window Scaling : on
TCP Appropriate Byte Count : on
TCP Selective Acknowledgements : on
TCP Forward RTO-Recovery[F-RTO] : off
Page 109 of 130
Module 2 – Network Protection

TCP TIMESTAMPS : off

Strict ICMP Tracking : off
ICMP Error Message : allow
IPv6 Unknown Extension Header : deny

Bypass Stateful Firewall

------------------------
Source Genmask Destination Genmask

NAT policy for system originated traffic

---------------------
Destination Network Destination Netmask Interface SNAT IP
Strict Policy
When strict policy is applied, appliance drops specific traffic and attacks like :-
1. Winnuke attack: In Winnuke attack, the attacker sets the rarely used URG flag (Urgent flag) in the TCP
header, which tells the receiving system to process the packet urgently. Within this time, it creates a loop
and hence the receiving system goes down due to high utilization of CPU.
2. Land attack: LAND attack, known as LAN Denial attack, is a DoS attack targeted on a system within a
LAN. It sends a spoofed packet to the receiver which in turn locks it up.
3. TCP/UDP destination/source port 0: These type of attacks are targeted to make the remote system go
high on CPU utilization. In these types of attacks, TCP or UDP destination/source port is 0. Since this port
cannot be reached, the remote system keeps on retrying and ends up in a loop.
4. Data on TCP Sync: Many times attackers send some data on the TCP Sync Packet. Such type of data are
usually system commands or many times spoofed messages which are capable enough to lock a remote
computer.
5. Zero IP Protocol: When a Zero is set in the sender IP, the receiver keeps on trying to send an ACK to
[Link], however since this address is not valid, the receiver system goes down.
6. TTL Value 0: When TTL value is set to 0, the receiver cannot send any messages to the sender system.
For every communication, it receives an error “transmit failed”. This type of attack makes the receiver
system inoperative of any communication because the immediate router will have TTL 0, which means all
communication to the immediate router will be dropped.
By Default, Strict Policy is always on. To turn the strict policy on or off go to use the CLI command set
advanced-firewall strict-policy on/off
FtpBounce Prevention
FTP Bounce Attack:

Page 110 of 130

Module 2 – Network Protection

When connecting to FTP server, the client sends a PORT command specifying the IP address and port to
which the FTP server should connect and send data. The FTP Bounce attack is when an attacker sends a
PORT command specifying the IP address of a third party instead of the attacker's own IP address. The FTP
server then sends data to the victim machine.
By Default, FTP Bounce Prevention is always on and it is set to Controlling the FTP connection.
There are two method to stop FTP Bounce Attack:
Control : Controlling the FTP connection
Data : Controlling the Data connection
Established TCP Connection Idle Timeout
• Connections that are closed (ACK for a FIN) are removed from the connection table. If the
connection isn't observed to be closed it stays open - either because it's still active, or because the
UTM didn't see it being closed (it's a stale connection that the endpoints intended to close but the
appliance somehow didn't see it).
• This value resets whenever a packet is seen in the connection, but iptables applies this value from
beginning to end. If you make this value too short then a valid connection that is passing data will
be removed after that time period.
• Default Idle timeout value for the established TCP connection is 10800 seconds (3 hours). This value
can be changed using below command:
console> set advanced-firewall tcp-est-idle-timeout <value in Seconds>
<2700-432000> Number in given range (inclusive)
Midstream Connection Pickup
• The Midstream Connection Pickup is OFF by default.
• It can be used to avoid downtime for the first time deployment in the bridge mode.
• It identifies the existing connections at the time of bridge mode deployment and creates conntrack
entries to avoid packet drops for ongoing sessions.
NAT Policy for System originated traffic
A local NAT policy is used when you want the appliance to go forward with a different IP, rather than its
masqueraded IP. Local NAT is used when traffic originating from the appliance (such as webcat updates, AV
definition updates, or IPS updates) need to reach the Internet. If the device has multiple WAN links
terminated on it and the requirement is to reach the Internet using a specific IP address for all Device
generated traffic, Local NAT can be used to define which IP will be used for traffic that originates from the
Sophos Firewall.
In order for the appliance-generated traffic to reach the Internet, the appliance needs a public IP which can
be configured by using the following command from the console window:
set advanced-firewall sys-traffic-nat add destination <IP or network> netmask <netmask> snatip
<assigned Public IP>
By entering this command, all of the appliance-generated traffic will be NATed with the entered public IP.

Page 111 of 130

Module 2 – Network Protection

Conntrack Helper Modules

• Protocols like FTP, SIP and H.323 use different flows for signaling and data
transfers
• Netfilters provides Connection Tracking helpers that assist the firewall in
tracking these protocols
console> system system_modules show
pptp loaded
h323 loaded
tftp loaded
irc loaded
sip not loaded
dns loaded
console> system system_modules sip load
console> system system_modules show
…
sip loaded

Conntrack Helper Modules

Protocols like FTP, SIP and H.323 uses different flows for signaling and data transfers. In the setup stage, it
is common that the signaling flow is used to negotiate the configuration parameters for the establishment
of the data flow (the IP address and port that are used to establish the data flow). These protocols are
harder to filter by firewalls since they violate layer 3/4 parameters in the OSI layer 7.
To overcome this situation in the iptables firewall, Netfilter provides the Connection Tracking
helpers. These modules assist the firewall in tracking these protocols. These helpers create the so-called
expectations, as defined by the Netfilter. An expectation is similar to a connection tracking entry, but it is
stored in a separate table and generally with a limited duration. Expectations are used to signal the kernel
that in the coming seconds, if a packet with corresponding parameters reaches the firewall, then this
packet is RELATED to the previous connection.
Commands to retrieve connections.
Conntrack –L: To list existing connections, here the connection is displayed after first packet of the
connection traverse complete firewall and went out from firewall.
To check if any connection is removed due to any validation before packets went out from Firewall, you
can check using below command.
Conntrack –E: To see live connections where you can see status like NEW, UPDATE and DISTROY. Here
connection is visible after “PREROUTING” hook and “raw” table with “NEW” status, and will keep updating
based on firewall marking and so on.
If you are not receiving connection here as well for which you are getting packet in TCPDUMP, this network
should be added in STATEFULL BYPASS configuration under CLI option of ADVANCE FIREWALL.

Page 112 of 130

Module 2 – Network Protection

Conntrack –E expect: To get detail info about the connection which are expected based on the existing
connection. Like wise in SATC we add expected connection from particular user and when actual request
comes we relate it with it’s actual connection.
To verify loaded helper modules, use below command in the console:
console> system system_modules show
pptp loaded
h323 loaded
tftp loaded
irc loaded
sip not loaded
To load helper module, use below command:
console> system system_modules <module name> load
ports Provide comma separated port list <Maximum 8 ports>
<ENTER> Further Arguments are optional

Troubleshooting
VLAN

Page 113 of 130

Module 2 – Network Protection

Troubleshooting VLAN
Console commands
console> system bridge max_bridge_members show
64 Bridge Member limit

console> system bridge max_bridge_members set limit

<2-256>

# brctl show
bridge name bridge id STP enabled Routing
Asmmetric_path Unknown_Network VLAN allowed Default VLAN
interfaces
GuestAP 8000.f266d6f4d76d no no no
no no 0
Bridge configuration

Troubleshooting VLAN
Console commands
VLAN enhancements
• VLAN interfaces can be created on unbound physical interfaces with no zone or network
configuration.
• VLAN interface can be a member of bridge
• VLAN interface can be configured on Bridge
• VLAN interface on Bridge members
• VLAN interface on Unbinded Physical Interface
• Limit maximum number of bridge members to 64
• VLAN filtering is possible in bridge interface and VLAN ID 1 can be configured now
system bridge max_bridge_members set limit <2-256> :- To configure the max limit of members that can
be added to bridge.
[Click]
The database table “tblinterface” give information about bridge interface
[Click]
brctl show :- It shows us detail about bridge configuration
Use case scenario:-

Page 114 of 130

Module 2 – Network Protection

1) Three Physical interface, not physically bridged. Three separate VLAN created - one on each.
Bridged those three VLANs. Routing on the Physical interfaces should work as normal. Traffic can
be configured to be routed from physical interface to one of the VLAN( ex. PortA to PortB,
PortA.100 to PortC.100, br0 to PortB)
2) Three Physical interface, physically bridged. Three separate VLAN created - one on each. Bridged
those three VLANs. Routing on Physical interfaces should work as normal. Traffic can be configured
to be routed from a physical interface to one of the VLANs or between VLANs. (ex. PortA to PortB
via br1, br1 to br0, PortA.100 to PortC.100, PortA to PortB)
3) Three Physical interface, physically bridged. Three separate VLAN created - one on each. Routing on
physical interface should work as normal. Traffic can be configured to be routed from physical
interface to one of the VLAN or between VLANs.(ex PortA to PortB, PortA.100 to PortB.100, br0 to
PortD Internet traffic)
4) Three Physical interface, physically bridged. Two VLAN created that bridges all three physical.
Routing on physical interface should work as normal. Traffic can be configured to be routed from
Physical interface to one of the VLANs or between VLANs(ex. PortB to PortC, br0 to br0.100,
br0.100 to br0.200, br0.100 to PortD)
5) Two Physical interface, configured separately. One VLAN is created on each. Bridge is created with
one Physical and 2 VLAN interfaces ()

Page 115 of 130

Module 2 – Network Protection

Troubleshooting VLAN
Verifying filtering settings
# psql -U nobody -d corporate -c "select * from tblbridgedetail"
interface | routingallow | asymallow | unknetworkallow | description | allowvlan | vlan |
arpbroadcast | stp | maxage | macaging | filtervlan | filterethertype
-----------+--------------+-----------+-----------------+-------------+-----------+------
+--------------+-----+--------+----------+------------+-----------------
bridge1 | 0 | 1 | 1 | | 1 | 0 |
1 | 0 | 20 | 300 | 1 | 0
(1 row)
# psql -U nobody -d corporate -c "select * from tblbridgevlanfilter" Vlan Filtering is enabled
interface | permittedvlans
-----------+----------------
bridge1 | 100 VLAN configuration for
bridge1 | 1-10
specific interface
# bridge -c vlan show dev Port3
port vlan ids Permitted VLAN for
Port3 5
specific Interface
# bridge vlan
port vlan ids
Port3 5 List of all VLAN
Port4 6 configuration
Port5 9

Troubleshooting VLAN
Verifying filtering settings
• Vlan filter helps us to add enable/disable VLAN filter(Permitted VLAN tags) for bridge interface so
that VLANs may pass over a bridge and the firewall can filter and enact policy on the tagged traffic,
without requiring an interface in the VLAN
• All Untagged traffic is allowed regardless of VLAN Filtering configuration.
• Only bridged traffic will be filtered, any system destined or routed traffic will not get filtered.
The tblbridgedetail and tblbridgevlanfilter will store the value that VLAN filtering is enabled or
not (Enhanced existing table).
[Click]
bridge -c vlan show dev Port3 command will give configured permitted VLAN in compressed form.
[Click]
bridge vlan or bridge vlan show both commands will give complete list of VLAN's configured on that dev
For packet flow
drppkt - to list the dropped packets
tcpdump - to analyze the packet flow
conntrack - to list the connectione details.
# ls -lah | grep "csc\|applog\|networkd"
-rw-r--r-- 1 root 0 16.9M Dec 4 14:47 [Link]

Page 116 of 130

Module 2 – Network Protection

-rw-r--r-- 1 root 0 78.5M Dec 4 14:49 [Link]

-rw-r--r-- 1 root 0 578.4K Dec 4 10:55 [Link]
# drppkt host [Link]
# tcpdump -ni any host [Link]
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
# conntrack -L [Link]
For configuration issues look into:-
[Link]
[Link]
[Link]
The tblinterface and tblipaddress tables are used to store VLAN Interface
# psql -U nobody -d corporate -c "select * from tblinterface"
interface | enabled | linktype | mtu | mss | interface_speed | overridemac | zoneid | parentinterface
| memberof | name
-----------+---------+----------+------+------+-----------------+-------------------+--------+-----------------+----------+------------
Port1 | 0| 0 | 1500 | 1460 | auto | | 1| | | Port1
Port1.1 | 0| 2 | 0 | 0 | auto | | 1 | Port1 | | test_vlan1
# psql -U nobody -d corporate -c "select * from tblipaddress"
interface | ipaddress | netmask | ipassigntype | ipfamily | ipsequence | id
-----------+---------------+---------------+--------------+----------+------------+----
Port1 | [Link] | [Link] | 0|0 | -1 | 2
Port1.1 | [Link] | [Link] | 0|0 | -1 | 1
Port1.1 | 2001:db8::100 | 64 | 0|1 | -1 | 7
# ifconfig Port1.1
Port1.1 Link encap:Ethernet HWaddr 7C:5A:1C:6D:25:7C
inet addr:[Link] Bcast:[Link] Mask:[Link]
inet6 addr: 2001:db8::100/64 Scope:Global

Page 117 of 130

Module 2 – Network Protection

Troubleshooting Extended Bridge

Verify Spanning Tree Protocol (STP)
# brctl showstp br0
New
bridge id 8000.000c2904eea0 STP details
designated root 8000.000c2904eea0
root port 0 path cost 0
max age 2000.00 bridge max age 5000.00
hello time 200.00 bridge hello time 500.1677
forward delay 3750.00 bridge forward delay 1500.1684
ageing time 30000.00 gc interval 0.00
hello timer 30.00 tcn timer 0.01
topology change timer 0.782 gc timer 13204.00
flags
STP State
Port1.10 (15)
port id 8001 state FORWARDING
designated root 8000.000c2904eea0 path cost 100
designated bridge 8000.000c2904eea0 message age timer 0.00
designated port 8001 forward delay timer 0.00
designated cost 0 hold timer 0.00
flags
Port2.11 (16)
port id 8002 state FORWARDING
designated root 8000.000c2904eea0 path cost 100
designated bridge 8000.000c2904eea0 message age timer 0.00
designated port 8002 forward delay timer 0.00
designated cost 0 hold timer 0.00
flags

Troubleshooting Extended Bridge

Verify Spanning Tree Protocol (STP)
The command “brctl showstp br0” give information about STP i.e. Bridge ID, Root Port, Path Cost etc
It also include different STP State i.e. Blocking, Listening, Listening and Listening
With v18, A bridge can exist without configuring IPv4 or IPv6
Allow ARP broadcasts: This function allows you to configure whether global ARP broadcasts should be
forwarded by the bridge. If enabled, the bridge will allow broadcasts to the MAC destination
address FF:FF:FF:FF:FF:FF. This, however, could be used by an alleged attacker to gather various
information about the network cards employed within the respective network segment or even the
security product itself. Therefore, the default setting is not to let such broadcasts pass the bridge.
Spanning Tree Protocol: Enabling this option will activate the Spanning Tree Protocol (STP). This network
protocol detects and prevents bridge loops.
MAC Ageing timeout: The amount of time in seconds after which an inactive MAC address will be deleted.
The default time is 300 seconds.
Forwarded EtherTypes: By default, a bridge configured on Sophos UTM only forwards IP packets. If you
want additional protocols to be forwarded, you have to add their EtherType to this box. The types have to
be entered as four-digit hexadecimal numbers. Popular examples are AppleTalk (type 809B), Novell (type
8138), or PPPoE (types 8863 and 8864). A typical use case would be a bridge between your RED interfaces
which should forward additional protocols between the connected networks.
brctl showstp br0 command show us detail about all STP configuration i.e. designated root, Root Port, Path
Cost etc. and information about the STP State i.e. Disabled, Blocking, Learning, Listening & Forwarding

Page 118 of 130

Module 2 – Network Protection

Note:
• The STP option on bridge is disabled in HA setup
• When the "Filter Ethertype filtering" is on by default the bridge allows the following frames
- ARP, IPv4, IPv6, 8021Q, EXTE
• The Bridge without IP, the following configuration won't work
- Legacy Proxy
- MASQ between different type of interface within bridge
Verify database entries
# psql -U nobody -d corporate -c "select * from tbllogtypes where logtype = 'Bridge ACLs’”
logtypeid | logtype | parentid | status | systemid | displaylable
-----------+-------------+----------+--------+----------+---------------------
115 | Bridge ACLs | 1| 0| 86 | [Link]
# psql -U nobody -d corporate -c "select * from tblbridgedetail"
interface | routingallow | asymallow | unknetworkallow | description | allowvlan | vlan | arpbroadcast |
stp | maxage | macaging | filtervlan | filterethertype
-----------+--------------+-----------+-----------------+-------------+-----------+------+--------------+-----+--------+----------+----
--------+-----------------
br0 | 0 | 1 | 1 | | 1 | 0 | 0 | 0 |
20 | 300 | 0 | 1
# psql -U nobody -d corporate -c "select * from tblbridge_ethertype_rel”
interface | ethertype | isdefault
-----------+-----------+-----------
br0 | 8688 | 0
br0 | 0900 | 0

Page 119 of 130

Module 2 – Network Protection

Troubleshooting Extended Bridge

Verify with ebtables
# ebtables -L
Bridge table: filter

Bridge chain: INPUT, entries: 0, policy: ACCEPT

Bridge chain: FORWARD, entries: 2, policy: ACCEPT

-j wpclientisolation
--logical-in New -j New_FORWARD

Bridge chain: OUTPUT, entries: 0, policy: ACCEPT

Bridge chain: wpclientisolation, entries: 0, policy: RETURN

Bridge chain: New_FORWARD, entries: 1, policy: ACCEPT

-p 0x806 --logical-in New --arp-mac-dst Broadcast --nflog-prefix
"0186361" --nflog-group 1 -j DROP

Troubleshooting Extended Bridge

Verify with ebtables
ebtables is an application program used to set up and maintain the tables of rules (inside the Linux kernel)
that inspect Ethernet frames. It is analogous to the iptables application, but less complicated, due to the
fact that the Ethernet protocol is much simpler than the IP protocol.
In this example, Ebtables ( filters used on the Ethernet layer) is showing details of arp broadcast settings
which is been not permitted from UI.
Check for dropped packets
drppkt host [Link] :- It show packets which are getting dropped due to ARP Broadcast not allowed.
This function allows you to configure whether global ARP broadcasts should be forwarded by the bridge. If
enabled, the bridge will allow broadcasts to the MAC destination address FF:FF:FF:FF:FF:FF.
# drppkt host [Link]
Date=2019-11-14 Time=07:27:34 log_id=0186361 log_type=Firewall log_component=Bridge ACLs
log_subtype=ARP broadcast log_status=Deny log_priority=Alert duration=N/A in_dev=Port3
out_dev=Port4 inzone_id=0 outzone_id=0 source_mac=08:00:27:ac:ec:4f dest_mac=ff:ff:ff:ff:ff:ff
ether_type=ARP (0x0806) source_ip=[Link] dest_ip=[Link] arp_opcode=1
arp_source_mac=08:00:27:ac:ec:4f arp_dest_mac=ff:ff:ff:ff:ff:ff fw_rule_id=N/A policytype=0
live_userid=0 userid=0 user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0
hb_src=0 hb_dst=0 dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0
bandwidth_id=0 up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x0 nfqueue=0
gateway_offset=0 connid=0 masterid=0 status=0 state=0, flag0=0 flags1=0 pbdid_dir0=0 pbrid_dir1=0
drppkt –i Port3 :- It show packets which are getting dropped due to EtherType filtering is not allowed
Page 120 of 130
Module 2 – Network Protection

By default, a bridge configured on Sophos XG only forwards IP packets. If you want additional protocols to
be forwarded, you have to add their EtherType to this box.
# drppkt –i Port3
Date=2019-11-14 Time=08:14:36 log_id=0186371 log_type=Firewall log_component=Bridge ACLs
log_subtype=EtherType filtering log_status=Deny log_priority=Alert duration=N/A in_dev=Port3
out_dev=Port4 inzone_id=0 outzone_id=0 source_mac=56:00:00:00:00:00 dest_mac=08:00:00:00:00:00
ether_type=Unknown (0x7558) l4_protocol=0 fw_rule_id=N/A policytype=0 live_userid=0 userid=0
user_gp=0 ips_id=0 sslvpn_id=0 web_filter_id=0 hotspot_id=0 hotspotuser_id=0 hb_src=0 hb_dst=0
dnat_done=0 icap_id=0 app_filter_id=0 app_category_id=0 app_id=0 category_id=0 bandwidth_id=0
up_classid=0 dn_classid=0 nat_id=0 cluster_node=0 inmark=0x0 nfqueue=0 gateway_offset=0 connid=0
masterid=0 status=0 state=0, flag0=0 flags1=0 pbdid_dir0=0 pbrid_dir1=0

Country Mapping
Troubleshooting incorrect country mapping
• Utilize MaxMind database for IP Address mapping
• Periodic updates over up2date
• [Link]

console> show country-host ip2country ipaddress <address>

x.x.x.x belongs to country <country>.

Country Mapping
Troubleshooting incorrect country mapping
In an incident that an IP address is incorrectly classified with the wrong country, it is likely that the Sophos
Firewall GeoIP up2date packages have not yet updated. These updates are done intermittently compared
to other up2date packages. Usually every 1-3 months.
The first recommended step is use [Link] and enter the IP address in question to validate the
country – most of the time, this IP will contain the correct country. However when you look on the Sophos
Firewall and run an ip2country lookup from the console using:
console> show country-host ip2country ipaddress <address>
This may display the outdated/incorrect country. If this is the case you’ll have to just suggest to the
customer to wait for the next GeoIP upd2ate package. For the time being, a manual firewall rule can be
created in its place.

Page 121 of 130

Module 2 – Network Protection

Troubleshooting Dynamic DNS

Debugging services and checking configurations
# service -S | grep "WINGc\|ddc"
WINGc RUNNING
ddc RUNNING,DEBUG

# ls -lah [Link] [Link]

-rw-r--r-- 1 root 0 22.6M Dec 5 00:56 [Link]
-rw-r--r-- 1 root 0 732.1K Dec 5 01:43 [Link]

# cat /cfs/ddclient/[Link]
daemon=300
ssl=yes
timeout=120
......

# /sdisk/ddclient/[Link]

Troubleshooting Dynamic DNS

Debugging services and checking configurations
On the backend we have moved from an in-house DDNS service to the open source ddclient.
Note that the refresh interval is no longer shown in the WebAdmin and is now a static 5 minute interval.
WINCc is responsible for DDNS of Sophos (in-house DDNS service ) and ddc is used for all external DDNS
(open source ddclient)
[Link] and [Link] file will be used for respective troubleshooting for DDNS
[Link] is a configuration file which stores all detail for DDNS. Open Source ddc provides HTTPS
support
[Link] is a cache file which you used for DDNS
Note: Sophos does offer a DDNS service, however this is being discontinued after January 31s, 2022.

Page 122 of 130

Module 2 – Network Protection

Jumbo frame support

Settings for MTU/MSS on the WebAdmin

Command to set MTU from console:

console> set network mtu-mss Port1 mtu 9000 mss default

Jumbo frame support

Settings for MTU/MSS available on the WebAdmin and in the CLI
Jumbo Ethernet frames to enhance network throughput, you can set MTU/MSS value either via GUI or CLI.
Enabling jumbo frames can improve network performance by making data transmissions more efficient.
MTU max range should be 9000, mss max range should be 8960.
Supported interfaces:
• Physical Interface
• VLAN
• LAG
• Bridge
• PPPoE
CPUs on switches and router can only process one frame at a time. By putting a larger payload into each
frame, the CPUs have fewer frames to process. In return, this can reduce the amount of heat the network
devices generate. if each link in the network path including servers and endpoints are configured to enable
jumbo frames at the same MTU then only it enhances network throughput otherwise, performance may
actually decrease as incompatible devices drop frames or fragment them, which can task the CPU with
higher processing requirements.
Enabling jumbo frames may also increase packet loss rates. The presence of jumbo frames may have an
adverse effect on network latency, especially on low bandwidth links. The frame size used by an end-to-
end connection is typically limited by the lowest frame size in intermediate links.

Page 123 of 130

Module 2 – Network Protection

• Jumbo frame in Sophos Firewall is supported for both IPv4 and IPv6 families.
• VFP/NFP supports jumbo frames.
• VPN, RED and WiFi interfaces, IP tunnel, GRE are not planned to support jumbo frames.
By default, the PPPoE interface supports a payload of 1492 Bytes. Now to accommodate a payload higher
than 1492, RFC-4638 supports an MTU of upto 1500B (Baby Jumbo Frames) on PPP interface if the
underlying physical interface supports at least 1500 MTU.
CLI command to verify/update MTU/MSS value:
console> show network mtu-mss <interface no.>
console> set network mtu-mss <interface no.> mtu <new mtu value> mss <new mss value>
console> set network mtu-mss Port1 mtu 9000 mss default
console> show network mtu-mss Port1
MTU MSS
--- ---
9000 8960

Page 124 of 130

Module 2 – Network Protection

Troubleshooting SNMPv3
Verify communication and configuration
# tcpdump -nvvv port 161 or port 162
2019-07-11 15:43:32 <UNKNOWN> [UDP: [[Link]]:35726->[[Link]]:162]: Tracing SNMP
iso.[Link].[Link] = Timeticks: (25930) 0:04:19.30 iso.[Link].[Link].1.0
= OID: iso.[Link].1.2064.[Link] iso.[Link].1.2064.[Link] = STRING: "SF01V_SO01_SFOS 18.0.0 Alpha
" iso.[Link].1.2064.[Link] = STRING: "SFOS 18.0.0 Alpha" iso.[Link].1.2064.[Link] = STRING: "SFDemo-
5d273ab" iso.[Link].1.2064.[Link] = STRING: "notification-device" iso.[Link].1.2064.[Link] = Hex-STRING:
07 E3 07 0B 0F 2B 1F iso.[Link].1.2064.[Link].0 = STRING: " Alert_Id : 17513 Message : New Firmware Up2Date
is available for installation"

# cat /cfs/system/[Link]
agentAddress udp:161,udp6:161 SNMP
sysName SFOS
syslocation India Configuration file
sysContact Admin
CreateUser 'SFOS' SHA256 "Sophos19851985" AES "Sophos19851985"
rouser 'SFOS'
authtrapenable 1
trapsess -v 3 -Ci -u "SFOS" -a SHA256 -A "Sophos19851985" -x AES -X "Sophos19851985" -l authPriv [Link]
monitor -u 'SFOS' -r 5 -e linkUpTrap 'Generate linkUp' '.[Link].[Link].1.8' != 2
monitor -u 'SFOS' -r 5 -e linkDownTrap 'Generate linkDown' '.[Link].[Link].1.8' == 2
notificationEvent linkUpTrap '.[Link].[Link].5.4' '.[Link].[Link].1.1' '.[Link].[Link].1.2'
'.[Link].[Link].1.7' '.[Link].[Link].1.8'
notificationEvent linkDownTrap '.[Link].[Link].5.3' '.[Link].[Link].1.1' '.[Link].[Link].1.2'
'.[Link].[Link].1.7' '.[Link].[Link].1.8’

# tail -f /log/[Link]
2020-10-28 16:08:54 snmpd: send_trap: Timeout SNMP Log file
2020-10-28 16:08:55 snmpd: send_trap: Timeout

Troubleshooting SNMPv3
Verify communication and configuration
Support for SNMPv3 is added, providing more flexibility and security over SNMPv2.
SNMP (Simple Network Management Protocol) gives access to Sophos Firewall information such as: status
of the firewall, service availability, CPU, memory, and disk usage. Sophos Firewall now supports SNMPv3
users in addition to SNMPv1 and SNMPv2c protocols, ensuring confidentiality, message integrity, and
validity of the user.
Run a tcpdump to verify that the SNMP query (port 161) and trap (port 162) is transferred to the
customers management solution.
Check the [Link] file under /cfs/system/ to see the agent configuration and passwords.
Log file Path :- /log/[Link]
The configuration should also be verified in the configdb:
# psql -U nobody -d corporate -c "select * from tblsnmpmanagerconf"
id | name | source | username | password | v1 | v2c | v3 | security | descript
ion | trapv1 | trapv2c | trapv3 | encryptalgo | authalgo | encryptkey | mib
object | authtype
----+------+--------+----------+----------+----+-----+----+----------+---------
----+--------+---------+--------+-------------+----------+----------------+----
-------+----------------

Page 125 of 130

Module 2 – Network Protection

1| | | admin | | 0| 0| 1| |
| 0| 0| 1| 1| 2 | Sophos19852019 |
| Sophos19852019
(1 row)
# psql -U nobody -d corporate -c "select * from tblsnmpv3trapiplist"
username | ipaddress
----------+-------------
SFOS | [Link]
(1 row)
Note: Customers can download a Management Information Base (MIB) from our documentation website:
[Link]

Quality of Service
Flow monitor

Auto-refresh
Session total count

Quality of Service
Flow monitor
We have below list of enhancements with v18 for Flow monitoring live connection
• Auto Refresh
• WAN Originated Traffic should also be displayed under Live connections
• Live Bandwidth calculation
• Application categories for each connection

Page 126 of 130

Module 2 – Network Protection

Minimum Escalation Requirements (MER)

• Please refer to the MER KB Article for Network Protection:
o [Link]

• Please refer to the MER KB Article for Basic Networking:

o [Link]

Minimum Escalation Requirements (MER)

Please refer to the MER KB Article for Network Protection:
[Link]
Please refer to the MER KB Article for Basic Networking:
[Link]

Page 127 of 130

Module 2 – Network Protection

Module Objectives
On completion of this module you are now able to:
ü Describe firewall flow and Troubleshooting
ü Describe the XStream architecture
ü Understand and Troubleshoot Fastpath related issue
ü Troubleshoot the Rules and Policies
ü Troubleshoot Enterprise NAT
ü Understand and Troubleshoot Routing related issues
ü Understand the Fine Tuning IPS settings available in the CLI
ü Understand the advanced firewall settings
ü Troubleshoot Advance deployment with VLAN and Extended Bridge
ü Troubleshoot Dynamic DNS and Jumbo Frame
ü Understand the SNMP Troubleshooting

Page 128 of 130

Module 2 – Network Protection

Page 129 of 130

Module 2 – Network Protection

Page 130 of 130

Sophos Firewall Rule Management Guide
No ratings yet
Sophos Firewall Rule Management Guide
50 pages
Advanced Rule Management for Sophos Firewall
No ratings yet
Advanced Rule Management for Sophos Firewall
50 pages
Advanced Firewall Rule Management Guide
No ratings yet
Advanced Firewall Rule Management Guide
50 pages
Configuring Screened Subnet Firewalls
No ratings yet
Configuring Screened Subnet Firewalls
59 pages
Understanding Firewalls in Network Security
No ratings yet
Understanding Firewalls in Network Security
50 pages
Firewalls and Virtual Private Network (VPN)
No ratings yet
Firewalls and Virtual Private Network (VPN)
78 pages
Understanding Firewall Types and Functions
No ratings yet
Understanding Firewall Types and Functions
37 pages
Firewall Lec 14, 15
No ratings yet
Firewall Lec 14, 15
57 pages
Understanding Firewalls and VPNs
No ratings yet
Understanding Firewalls and VPNs
44 pages
Firewall Security and Design Principles
No ratings yet
Firewall Security and Design Principles
24 pages
Network Traffic Packet Fundamentals Module2
No ratings yet
Network Traffic Packet Fundamentals Module2
34 pages
Unit 5.3firewalls
No ratings yet
Unit 5.3firewalls
23 pages
Network Security Protocols Overview
No ratings yet
Network Security Protocols Overview
69 pages
Understanding Firewall Architectures
No ratings yet
Understanding Firewall Architectures
24 pages
Understanding Firewall Types and Functions
No ratings yet
Understanding Firewall Types and Functions
26 pages
Secure Network Infrastructure Overview
No ratings yet
Secure Network Infrastructure Overview
48 pages
Understanding Firewall Types and Limitations
100% (1)
Understanding Firewall Types and Limitations
94 pages
Firewalls and VPN
No ratings yet
Firewalls and VPN
48 pages
Understanding Firewalls and IDS
No ratings yet
Understanding Firewalls and IDS
46 pages
Network & Information Security: Unit 4: Firewall and Encryption Algorithms
No ratings yet
Network & Information Security: Unit 4: Firewall and Encryption Algorithms
45 pages
RSE Enterprise Firewall Overview
No ratings yet
RSE Enterprise Firewall Overview
29 pages
Introduction to Firewall Technology
No ratings yet
Introduction to Firewall Technology
33 pages
Firewall Types and Configurations Guide
No ratings yet
Firewall Types and Configurations Guide
43 pages
Essential Guide to Network Security
No ratings yet
Essential Guide to Network Security
25 pages
Unot 5
No ratings yet
Unot 5
55 pages
Firewalls in Cryptography and Security
No ratings yet
Firewalls in Cryptography and Security
21 pages
Understanding Firewall Types and Functions
No ratings yet
Understanding Firewall Types and Functions
33 pages
Secure Network Architectures
No ratings yet
Secure Network Architectures
67 pages
07 Middleboxes
No ratings yet
07 Middleboxes
61 pages
Understanding Packet Filtering Firewalls
No ratings yet
Understanding Packet Filtering Firewalls
49 pages
Understanding Firewall Types and Functions
No ratings yet
Understanding Firewall Types and Functions
24 pages
Understanding Firewall Concepts and Configurations
No ratings yet
Understanding Firewall Concepts and Configurations
263 pages
Firewall Overview and Types
No ratings yet
Firewall Overview and Types
62 pages
Unit 5 - System Security
No ratings yet
Unit 5 - System Security
41 pages
Firewall Types and Functions Overview
No ratings yet
Firewall Types and Functions Overview
50 pages
Lecture17 Firewall
No ratings yet
Lecture17 Firewall
25 pages
Firewall Configuration Essentials
No ratings yet
Firewall Configuration Essentials
76 pages
Chapter 10
No ratings yet
Chapter 10
39 pages
Outbound Packet Discard in Proxies
No ratings yet
Outbound Packet Discard in Proxies
38 pages
Circuit Proxy Filter Firewalls Explained
No ratings yet
Circuit Proxy Filter Firewalls Explained
36 pages
Understanding Strata Firewalls
No ratings yet
Understanding Strata Firewalls
14 pages
Firewall and Intrusion Prevention Systems
No ratings yet
Firewall and Intrusion Prevention Systems
37 pages
Understanding Computer Firewalls
No ratings yet
Understanding Computer Firewalls
7 pages
Understanding Firewall Protection Mechanisms
No ratings yet
Understanding Firewall Protection Mechanisms
100 pages
Cyber Security 5
No ratings yet
Cyber Security 5
4 pages
Network Security: Firewalls & IDS/IPS Overview
No ratings yet
Network Security: Firewalls & IDS/IPS Overview
46 pages
Understanding Perimeter Firewall Security
No ratings yet
Understanding Perimeter Firewall Security
70 pages
Understanding Firewalls and Their Types
No ratings yet
Understanding Firewalls and Their Types
29 pages
Firewall in Computer Network
No ratings yet
Firewall in Computer Network
6 pages
Configuring Firewall Security Settings
No ratings yet
Configuring Firewall Security Settings
24 pages
Unit 6 BC & CS
No ratings yet
Unit 6 BC & CS
11 pages
Understanding Firewalls and Their Types
No ratings yet
Understanding Firewalls and Their Types
33 pages
Step-by-Step Firewall Configuration Guide
No ratings yet
Step-by-Step Firewall Configuration Guide
59 pages
Understanding Firewalls: Types & Functions
No ratings yet
Understanding Firewalls: Types & Functions
61 pages
Understanding Firewall Technologies
No ratings yet
Understanding Firewall Technologies
169 pages
Firewalls and VPNs: Security Essentials
No ratings yet
Firewalls and VPNs: Security Essentials
52 pages
Network Security Protocols Overview
No ratings yet
Network Security Protocols Overview
126 pages
Network Protocols and Communication Rules
No ratings yet
Network Protocols and Communication Rules
11 pages
6.5.1.3 Packet Tracer Skills Integration Challenge
43% (7)
6.5.1.3 Packet Tracer Skills Integration Challenge
2 pages
Moxa PT-G7728 Series Switch Overview
No ratings yet
Moxa PT-G7728 Series Switch Overview
7 pages
Computer Networks Exam Questions Guide
No ratings yet
Computer Networks Exam Questions Guide
1 page
GameCenter Initialization Log Analysis
No ratings yet
GameCenter Initialization Log Analysis
18 pages
Telegram Debug Log Analysis
No ratings yet
Telegram Debug Log Analysis
9 pages
CCDP Arch 300-320 by Gon June 2018 173Q
100% (3)
CCDP Arch 300-320 by Gon June 2018 173Q
68 pages
Network Layer Functions and Protocols Guide
No ratings yet
Network Layer Functions and Protocols Guide
5 pages
TL-MR3420 - V5 - Datasheet
No ratings yet
TL-MR3420 - V5 - Datasheet
6 pages
Understanding IPv4 and IPv6 Differences
No ratings yet
Understanding IPv4 and IPv6 Differences
14 pages
TRILL
No ratings yet
TRILL
17 pages
Industrial Communication Project Report
No ratings yet
Industrial Communication Project Report
13 pages
VPN Applications in Data Security
No ratings yet
VPN Applications in Data Security
18 pages
Network Performance Optimization A Case Study of Enterprise Network Simulated in OPNET
No ratings yet
Network Performance Optimization A Case Study of Enterprise Network Simulated in OPNET
7 pages
2MP IR Bullet Camera Specifications
No ratings yet
2MP IR Bullet Camera Specifications
3 pages
Computer Networks: Unit 1 Overview
No ratings yet
Computer Networks: Unit 1 Overview
18 pages
Routing Attacks: Vulnerabilities & Solutions
No ratings yet
Routing Attacks: Vulnerabilities & Solutions
29 pages
Honor Device Startup Log Analysis
No ratings yet
Honor Device Startup Log Analysis
11 pages
GlobalProtect Clientless VPN Setup Guide
No ratings yet
GlobalProtect Clientless VPN Setup Guide
3 pages
Understanding Network Layer Protocols
No ratings yet
Understanding Network Layer Protocols
22 pages
iBGP vs eBGP: Key Differences Explained
No ratings yet
iBGP vs eBGP: Key Differences Explained
4 pages
FDM vs TDM in Circuit Switching
100% (1)
FDM vs TDM in Circuit Switching
46 pages
Service Manual of Ap9631
No ratings yet
Service Manual of Ap9631
28 pages
Cisco Business 350series Combo
No ratings yet
Cisco Business 350series Combo
5 pages
Nmap Scan Results for ADBox Resolute
No ratings yet
Nmap Scan Results for ADBox Resolute
10 pages
GameCenterBizApplication Startup Log
No ratings yet
GameCenterBizApplication Startup Log
12 pages
CCNP 300-101 ROUTE Exam Questions
No ratings yet
CCNP 300-101 ROUTE Exam Questions
56 pages
Eaton INDGW-M2 Gateway Card Overview
No ratings yet
Eaton INDGW-M2 Gateway Card Overview
2 pages
Vmess Proxy Configuration Guide
No ratings yet
Vmess Proxy Configuration Guide
2 pages
Troubleshooting Industrial Wireless Access Points
No ratings yet
Troubleshooting Industrial Wireless Access Points
18 pages

Network Protection Module Overview

Uploaded by

Network Protection Module Overview

Uploaded by

So

Module 2 – Network Protection handout

Version 20.0  July 2024

Module 1: Architecture and Troubleshooting basics

Once you complete this module you will be able to:

Firewall Framework and Xstream

Firewall Framework flow 5. Filter

PREROUTING ROUTING FORWARD POSTROUTING

1. RAW packet processing

Firewall Framework Flow

Firewall Framework flow

PREROUTING ROUTING ROUTING OUTPUT POSTROUTING Outgoing

8. Conntrack 10. Mangle

Tables Local Processes

Firewall Framework Flow

FastPath and Rule Troubleshooting

# lsmod | grep -i usfp XGS Hardware

VFP troubleshoot information will be saved to /var/tmp folder

Please review the contents of /var/tmp/fp_fw

USFP troubleshoot information will be saved to /var/tmp folder

Please review the contents of /var/tmp/fp_fw

Troubleshooting FastPath: Script

Troubleshooting Rules and Policies

Troubleshooting Rules and Policies

Troubleshooting Rules and Policies

Troubleshooting Rules and Policies

The above ID in fwruleid and Hostid can be check from IPSET

Troubleshooting Rules and Policies

Troubleshooting Rules and Policies

ENTITY all -- [Link]/0 [Link]/0 skip_ip_match ENTITY TARGET WEBFLT 0 APPFLT

Network Address Translation (NAT)

Enterprise NAT Implementation

MASQ/SNAT DNAT Full NAT

Linked NAT Explicit NAT Explicit NAT Explicit NAT

Enterprise NAT Implementation

Network Address Translation (NAT)

Change the Packet

Network Address Translation (NAT)

No SNAT or linked NAT rule will be matched (6)

Routing and SD-WAN

PBR: SD-WAN Route

Routing Polices RTG: Route Through Gateway

XGS87_SN01_SFOS 19.0.0 EAP2-Build267# ip ru ls

Mark Routing type

Routing Precedence 0 x 1xxx

SD-WAN routing (policy routing)

0 x 8xxx Multi link management (WAN link load balancing)*

0 x 8xxx Route through gateway (prior to v18)

0 x 2xx Policy based VPN

0x4001 (GW-1) Destination Next Hop

0x200 (ipsec0) Destination Next Hop

VPN routes B ipsec0 (PBVPN)

(GW-2) Destination Next Hop

0x8003 (GW3) Destination Next Hop

Dynamic and static routing

Log file Description

/log/[Link] MLM, VPN failover, Dead Gateway Detect

/log/[Link] - /log/[Link] - /log/[Link], Static and dynamic routing

/log/[Link] and /log/[Link] Multi-cast routing and Static Multi-cast Routes

/log/[Link], /log/[Link] and /log/[Link] Generic logs

Dynamic and static routing

Troubleshooting Dynamic and static routing

Troubleshooting Dynamic and static routing

# psql -U nobody -d corporate -c "select * from tblipaddress"

Port3 | [Link] | [Link] | 0|0 | -1 | 4

Troubleshooting Dynamic and static routing

# ip route get [Link]

Troubleshooting Dynamic and static routing

SFVUNL_HV01_SFOS 19.5.0 EAP1-Build144# ls –l /conf/routing

-rw-r--r-- 1 nobody nobody 78 Oct 18 15:22 [Link]

Configure Dynamic routing from CLI

Sophos Firmware Version: SFOS 19.5.0 EAP1-Build144

ospf# show debugging

IPv6 DHCP Prefix Delegation

IPv6 Standard Prefixes

/52 Provides 4096 individual /64 LANs ISP Router

Version 20.0 July 2024