topic Re: site-to-site vpn from Sophos in General Topics

site-to-site vpn from Sophos

dieter_b — Wed, 01 Apr 2015 15:03:28 GMT

IKE coming from a Sophos device is incorrectly identified as application ciscovpn instead of application ike.

Is this because Sophos uses cisco-ish protocol ? All I see in the logs is udp 500...

I'm happy allowing application ike, our other site-to-site vpn's work fine with it.

I'm not happy however with allowing ciscovpn, since that would open a bunch of other ports as well (source applipedia: tcp/500,2512,4500,10000, udp/500,4500,10000,62514-62524)

Has anyone noticed similar behaviour ? Can I do something about it ?

Re: site-to-site vpn from Sophos

pulukas — Thu, 02 Apr 2015 09:56:26 GMT

You could write a specific rule just for the Sophos site ip address as a port based rule before the application rule.

Re: site-to-site vpn from Sophos

dieter_b — Tue, 14 Apr 2015 08:56:53 GMT

That's what we did. But still, I would have expected it to work using only application ike...

Re: site-to-site vpn from Sophos

pulukas — Tue, 14 Apr 2015 09:54:22 GMT

This happens sometimes. Applications are classified based on the actual behavior and content of the packets. So the connection here was similar enough to the Cisco to make a match.

You could open a support case and provide the pcaps on the misclassification. Then the application signature might be able to be updated in a future release.