04-01-2015 08:03 AM
IKE coming from a Sophos device is incorrectly identified as application ciscovpn instead of application ike.
Is this because Sophos uses cisco-ish protocol ? All I see in the logs is udp 500...
I'm happy allowing application ike, our other site-to-site vpn's work fine with it.
I'm not happy however with allowing ciscovpn, since that would open a bunch of other ports as well (source applipedia: tcp/500,2512,4500,10000, udp/500,4500,10000,62514-62524)
Has anyone noticed similar behaviour ? Can I do something about it ?
04-02-2015 02:56 AM
You could write a specific rule just for the Sophos site ip address as a port based rule before the application rule.
04-14-2015 01:56 AM
That's what we did. But still, I would have expected it to work using only application ike...
04-14-2015 02:54 AM
This happens sometimes. Applications are classified based on the actual behavior and content of the packets. So the connection here was similar enough to the Cisco to make a match.
You could open a support case and provide the pcaps on the misclassification. Then the application signature might be able to be updated in a future release.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
