{"id":161511,"date":"2024-09-06T14:15:55","date_gmt":"2024-09-06T13:15:55","guid":{"rendered":"https:\/\/www.avanet.com\/?post_type=kb&#038;p=161511"},"modified":"2024-09-06T14:42:18","modified_gmt":"2024-09-06T13:42:18","slug":"sophos-firewall-dropped-packets","status":"publish","type":"kb","link":"https:\/\/www.avanet.com\/en\/kb\/sophos-firewall-dropped-packets\/","title":{"rendered":"Sophos Firewall &#8211; Detecting dropped packets"},"content":{"rendered":"\n<p>Sophos Firewalls can drop packages for various reasons.\nThis article explains how to recognize dropped packages, which tools are available for this and how common problems can be solved by appropriate configurations. <\/p>\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2>Topics<\/h2><nav><ul><li class=\"\"><a href=\"#1-verworfene-pakete-identifizieren\">Identify discarded packages<\/a><ul><li class=\"\"><a href=\"#schritte\">Step-by-step instructions<\/a><\/li><\/ul><\/li><li class=\"\"><a href=\"#2-haufige-fehlermeldungen-bei-verworfenen-paketen\">Frequent error messages for discarded packages<\/a><\/li><li class=\"\"><a href=\"#3-verwendung-des-packet-capture-tools\">Using the Packet Capture Tool<\/a><ul><li class=\"\"><a href=\"#schritte-1\">Step-by-step instructions<\/a><\/li><\/ul><\/li><li class=\"\"><a href=\"#4-problembehebung-anhand-von-beispielen\">Troubleshooting using examples<\/a><ul><li class=\"\"><a href=\"#4-1-verworfene-pakete-durch-firewall-regeln\">Dropped packets due to firewall rules<\/a><\/li><li class=\"\"><a href=\"#4-2-verworfene-pakete-durch-web-filter\">Discarded packages due to web filter<\/a><\/li><\/ul><\/li><li class=\"\"><a href=\"#5-best-practices\">Best Practices<\/a><\/li><li class=\"\"><a href=\"#6-weiterfuhrende-dokumentation\">Video<\/a><\/li><\/ul><\/nav><\/div>\n\n<h2 class=\"wp-block-heading\" id=\"1-verworfene-pakete-identifizieren\">Identify discarded packages<\/h2>\n\n<p>To recognize dropped packets, use the Sophos Firewall <strong>log viewer<\/strong>.\nThis shows which modules are responsible for dropping a packet.\nThe most important modules include:  <\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>Firewall<\/strong><\/li>\n\n\n\n<li><strong>Web filter<\/strong><\/li>\n\n\n\n<li><strong>Application filter<\/strong><\/li>\n\n\n\n<li><strong>Intrusion Prevention System (IPS)<\/strong><\/li>\n\n\n\n<li><strong>Advanced Threat Protection (ATP)<\/strong><\/li>\n\n\n\n<li><strong>Web Protection<\/strong><\/li>\n<\/ul>\n\n<p>By using filters in the Log Viewer, you can search specifically for discarded packages.\nFor example, you can set a filter that only shows packets that are not allowed. <\/p>\n\n<h3 class=\"wp-block-heading\" id=\"schritte\"><strong>Step-by-step instructions<\/strong><\/h3>\n\n<ol class=\"wp-block-list\">\n<li>Open the <strong>Log Viewer<\/strong>.<\/li>\n\n\n\n<li>Select the corresponding module (e.g. firewall).<\/li>\n\n\n\n<li>Add a filter that displays the discarded packages.\n<ul class=\"wp-block-list\">\n<li>Set the filter for &#8220;Log Subtype&#8221; to &#8220;Is Not Allowed&#8221;.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Analysis of the discarded packages based on the messages in the Log Viewer.<\/li>\n<\/ol>\n\n<p>Please note that the Log Viewer only saves a limited number of logs and is not suitable for real-time monitoring.\nFor real-time analysis, we recommend using the <strong>Packet Capture Tool<\/strong>. <\/p>\n\n<h2 class=\"wp-block-heading\" id=\"2-haufige-fehlermeldungen-bei-verworfenen-paketen\">Frequent error messages for discarded packages<\/h2>\n\n<p>Discarded packages can have various causes, which are displayed in the Log Viewer.\nThe most common error messages include <\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>Invalid Packet<\/strong>: Refers to rejected TCP RST or TCP FIN packets to prevent attacks.<\/li>\n\n\n\n<li><strong>No ICMP Record Found<\/strong>: A response ping was received without a corresponding request and discarded.<\/li>\n\n\n\n<li><strong>Could Not Associate Packet to Any Connection<\/strong>: The packet does not belong to any known connection and is discarded.<\/li>\n<\/ul>\n\n<p>Another scenario that can lead to dropped packets is <strong>asymmetric routing<\/strong>, where the firewall cannot assign the packets correctly.<\/p>\n\n<h2 class=\"wp-block-heading\" id=\"3-verwendung-des-packet-capture-tools\">Using the Packet Capture Tool<\/h2>\n\n<p>The <strong>Packet Capture Tool<\/strong> enables a detailed analysis of data traffic.\nThis allows administrators to see which firewall rules and security functions influence the data flow.\nFor example, it can be determined whether the web filter or another security function is blocking the packet.  <\/p>\n\n<h3 class=\"wp-block-heading\" id=\"schritte-1\"><strong>Step-by-step instructions<\/strong><\/h3>\n\n<ol class=\"wp-block-list\">\n<li>Navigate to <strong>Diagnostics &gt; Packet Capture<\/strong>.<\/li>\n\n\n\n<li>Configure the packet filter with the relevant IP addresses and protocols.<\/li>\n\n\n\n<li>Activate packet capture while the problem is being reproduced.<\/li>\n\n\n\n<li>Analysis of the recorded packets with regard to dropped or blocked connections.<\/li>\n<\/ol>\n\n<h2 class=\"wp-block-heading\" id=\"4-problembehebung-anhand-von-beispielen\">Troubleshooting using examples<\/h2>\n\n<p>The following describes some common scenarios in which packages are discarded and the corresponding solutions.<\/p>\n\n<h3 class=\"wp-block-heading\" id=\"4-1-verworfene-pakete-durch-firewall-regeln\">Dropped packets due to firewall rules<\/h3>\n\n<p>Example: An internal computer cannot ping another computer in the network.<\/p>\n\n<ul class=\"wp-block-list\">\n<li>Use the Packet Capture Tool to check whether the packets are received and forwarded by the firewall.<\/li>\n\n\n\n<li>If the packets are not forwarded, a missing firewall rule could be the problem.\nA new rule that allows ping traffic solves the problem. <\/li>\n<\/ul>\n\n<h3 class=\"wp-block-heading\" id=\"4-2-verworfene-pakete-durch-web-filter\">Discarded packages due to web filter<\/h3>\n\n<p>Example: A website such as <strong>youtube.com<\/strong> is blocked.<\/p>\n\n<ul class=\"wp-block-list\">\n<li>Check the web filter logs in the Log Viewer.<\/li>\n\n\n\n<li>If the website is blocked due to a policy, a new URL group can be created to allow specific websites while others remain blocked.<\/li>\n<\/ul>\n\n<h2 class=\"wp-block-heading\" id=\"5-best-practices\">Best Practices<\/h2>\n\n<ul class=\"wp-block-list\">\n<li>Avoid excessive exceptions: By creating exceptions for web filters, ATP or other security modules, administrators should ensure that network security is not compromised.<\/li>\n\n\n\n<li>Regular log monitoring: As the Log Viewer only saves a limited number of logs, it should be checked regularly to see whether discarded packets are critical or can be ignored.<\/li>\n\n\n\n<li>Use of real-time tools: The Packet Capture Tool is indispensable for effective troubleshooting, as it provides detailed information about packet traffic in real time.<\/li>\n<\/ul>\n\n<h2 class=\"wp-block-heading\" id=\"6-weiterfuhrende-dokumentation\">Video<\/h2>\n\n<p>Further information and detailed instructions can be found in this video<\/p>\n\n<script type=\"text\/javascript\" async=\"\" src=\"https:\/\/play.vidyard.com\/embed\/v4.js\"><\/script><img decoding=\"async\" style=\"width: 100%; margin: auto; display: block;\" class=\"vidyard-player-embed\" src=\"https:\/\/play.vidyard.com\/YgQhcc2VeGxx6A9uL14LD9.jpg\" data-uuid=\"YgQhcc2VeGxx6A9uL14LD9\" data-v=\"4\" data-type=\"inline\"\/>\n\n<p><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"template":"","format":"standard","kb_kategorie":[382],"class_list":["post-161511","kb","type-kb","status-publish","format-standard","hentry","kb_kategorie-sophos-firewall"],"blocksy_meta":[],"acf":[],"_links":{"self":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb\/161511","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb"}],"about":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/types\/kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/users\/1"}],"wp:attachment":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/media?parent=161511"}],"wp:term":[{"taxonomy":"kb_kategorie","embeddable":true,"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb_kategorie?post=161511"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}