topic Application match... Sophos-live-protection to 8.8.8.8 in General Topics

Application match... Sophos-live-protection to 8.8.8.8

RobinClayton — Wed, 05 Sep 2018 10:34:45 GMT

Our logs show a numebr of connections from our DC's to port "53" application sophos-live-protection...

That's fair enough, I understand the concept of what sophos are tryign to do with this.

What I don't understand is why the destination is 8.8.8.8 and not one of the sophos listening addresses...

I don't suppose anyone sees this?

Rob

Re: Application match... Sophos-live-protection to 8.8.8.8

TerjeLundbo — Wed, 05 Sep 2018 12:41:20 GMT

I've seen this before with some clients in our network. The clients had Sophos installed, and the software in some way manipulated DNS requests from the client (I haven't used Sophos myself so I cannot be any more specific). This would be DNS requests for external domains which is why your DC's forward them to external DNS servers. Palo Alto sees the DNS traffic, parses the content, notices the Sophos content and changes the appid from dns to sophos-live-protection.

We had a case with TAC about it, and the only solution they suggested was to make an Application Override.

Re: Application match... Sophos-live-protection to 8.8.8.8

BPry — Wed, 05 Sep 2018 13:39:47 GMT

@RobinClayton,

I expect that as @TerjeLundbo mentioned you have Sophos installed, which would explain why you are seeing this behavior. I don't actually recommend doing the application-override in this situation, however that would be a decision you need to make with the knowledge that application-override stops further application identification from taking place. Since DNS is a heavy target for tunneling all sorts of communication traffic, I personally would avoid this like the plague.

Re: Application match... Sophos-live-protection to 8.8.8.8

RobinClayton — Wed, 05 Sep 2018 14:03:55 GMT

(yes we do have Sophos, and I have asked them why it's hapening, not much help as yet)

I am not sure it's consistent with the explination above..

sophos-live-protection should send information to "SOPHOS" not to "GOOGLE" using port "53" ,

If the Sophos Client did a DNS lookup for the sophos destination, that would appear as standard DNS lookup via the Domain controller and be a standard DNS lookup on the firewall. Once that IP is resolved the sophos client would send a sophos-live-protection pracket using port 53 to that resolved destination ,not involving the Domain Controller and it would probably discard it anywa as a malformed DNS request.

Trying Packet captures is a bit fruitless as the source/destination/dport are all used by the legitmate DNS traffic.

Rob

Re: Application match... Sophos-live-protection to 8.8.8.8

BPry — Wed, 05 Sep 2018 14:11:50 GMT

@RobinClayton,

It's been a while since I supported any Sophos clients and really looked at this, but Sophos used to always send DNS queries with generic information regardless of what you were doing. Any DNS request also included a fair bit of Sophos required information, regardless of where it was destined.

Since this information is included within the DNS request, and since Palo Alto built the signature to look for this information, the DNS requests sent via a Sophos protected client will be recorded as sophos-live-protection.