Skip to content
Avanet

Sophos Firewall: Invalid TCP reserved bit caused by Accurate ECN

Sophos Firewall

If Sophos Firewall drops legitimate TCP traffic with Invalid TCP reserved bit, Accurate ECN may be the cause. An additional allow rule or a web filter exception does not help in this case because the drop occurs during strict TCP validation.

Sophos specifies disabling strict-policy globally as the workaround. This change should only be made after obtaining clear evidence: it applies to the entire firewall and does not relax the check only for the affected traffic flow.

Identify the error conclusively

The workaround is appropriate only when all of the following conditions apply:

  • A specific TCP connection reproducibly fails or cannot be established.
  • Log Viewer or Packet Capture shows Invalid TCP reserved bit as the drop reason.
  • The firewall rule, NAT, and routing match the expected traffic path.
  • A broad allow rule does not change the behaviour.
  • The packet capture shows the reused reserved TCP bit that Sophos refers to as NS. ECE and CWR may also be set, but on their own they do not conclusively prove Accurate ECN.

For the first test, filter by source IP, destination IP, and time under Log viewer > Firewall, and include Invalid Traffic. Then record exactly one connection attempt under Diagnostics > Packet capture. The general process is described in Analyse dropped packets on Sophos Firewall.

If the specific drop reason is missing, strict-policy should not be disabled as a precaution. First test the firewall rule, NAT, and packet flow.

Why Accurate ECN is identified as invalid

Explicit Congestion Notification, or ECN, signals congestion without dropping a packet solely for that purpose. Accurate ECN extends this mechanism, reuses the reserved NS bit, and combines it with ECE and CWR to provide more precise feedback.

Sophos states under NC-169842 that strict packet validation can interpret the NS bit used for this purpose as a set reserved TCP bit and drop the traffic. The log therefore shows Invalid TCP reserved bit, even though the sender is using the bits for Accurate ECN.

The current Sophos Known Issues List identifies SFOS 21.5.0 GA Build 171 as the affected version and does not yet list a fix version. If the same behaviour occurs on another SFOS version, open a support case with the packet capture and log excerpt instead of assuming that version is affected.

Check Strict Policy

Run the commands at the console> prompt of the Device Console, not in the Advanced Shell:

  1. Sign in to the firewall through SSH or the local console.
  2. Select 4. Device Console from the main menu.
  3. Display the current state:
show advanced-firewall

Find this line in the output:

Strict Policy                  : on

The complete output contains additional global firewall parameters. These should not be changed for this test. If access has not yet been configured, see Connect to Sophos Firewall through SSH.

Test the workaround in a controlled manner

⚠️ Security impact: strict-policy off disables strict packet validation globally. Sophos Firewall then no longer rejects certain unusual or potentially harmful packet patterns through this check. The command does not create an exception for an individual IP address, domain, or firewall rule.

Before making the change, save a current configuration state, document the affected test case, and schedule a maintenance window. Then run:

set advanced-firewall strict-policy off

Check the new state:

show advanced-firewall

Expected line:

Strict Policy                  : off

Now retest only the previously documented traffic flow. If it works immediately and the Invalid TCP reserved bit drop reason disappears, the link to Strict Policy is confirmed.

If the error remains unchanged, re-enable strict-policy immediately. The cause is then probably elsewhere in the packet flow.

Re-enable Strict Policy

The command to revert the change is:

set advanced-firewall strict-policy on

Then use show advanced-firewall again to verify that Strict Policy : on is displayed, and check normal traffic.

Even if the workaround works, strict-policy off should not become a permanent state without an assessment. The preferred order is:

  1. Check whether the sender, operating system, application, or upstream service can disable Accurate ECN or negotiate it differently.
  2. Check current SFOS maintenance releases and the Sophos Known Issues List for a fix version.
  3. Involve Sophos Support and provide the SFOS version, timestamp, source and destination, drop reason, and Packet Capture.
  4. Only if no narrower solution is possible, continue operating with the global change after accepting the risk and documenting monitoring and the rollback procedure.

The required evidence can be collected with Save Sophos Firewall logs for a support case.

What does not help

  • A broader firewall rule: Strict TCP validation is not normal rule matching.
  • Web or TLS exceptions: The drop can occur before these policies process the traffic.
  • An IPS exception as a precaution: For NC-169842, Sophos explicitly identifies Strict Policy as the cause and workaround.
  • Disabling the global setting without a baseline: Without a reproducible before-and-after test, there is no proof that Accurate ECN caused the issue.