WAAS Infrastructure with Sophos UTM

[Robert Voigtlaender]

Hi all,

we replaced our old ASA 5510 with a new Sophos SG230 appliance and can not get the exisitig WAAS infrastructure to work correctly. To simplify the setup:

LAN->WAVE-574 L0-WAVE-574 W0->Sophos->VPN TUNNEL->Sophos router->WAVE-474->remote LAN

Inception: Inline

As the Sophos has issues with the manipulated tcp sequence numbers, etc., i have enabled directed mode on the device group via the central manager and i see traffic flowing through the WAVE but the connection on the remote site does not work as expected. I can not reach remote resources and have got entries in the firewall log which look like "swapped" src/dst ports (e.g. connect to printer webinterface originating from port 80 and going to an random port).

Do i need to assign an IP address to the inline interface group? If so, how to do this? I tried, but got an error because the mgmt interface is in the same subnet?!

Has someone got this setup working with Sophos?

Thanks in davance guys!

Cheers

Bartosch

[Beau Clark]

Not much can be done on the Cisco side of this. On an ASA firewall, you simply add the "inspect WAAS" to your global policy. On the Sophos side, you will have to open a ticket with Sophos and ask them how to turn off "stateful inspection" of your specific traffic. 

[Robert Voigtlaender]

Hi Beau Clark,
yeah thanks for the ASA advice – we had that. My question was pointed more on the directed mode as this is the way to circumvent this issues if I get it right.

[Beau Clark]

The WAN accelerators renumber the tcp packets to identify a WAAS peer on the other end. Firewalls (in general) see this traffic as not sequenced tcp traffic. So all firewalls that do "stateful inspection" will drop these packets, you could create a permit ip any any rule and this traffic would still be dropped. So when you talk to Sophos, tell them you want to turn off "stateful inspection" for this traffic. 

Try this:

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/92313/strange-drops

Rules here:

set advanced-firewall bypass-stateful-firewall-config add source_network 10.10.90.0 source_netmask 255.255.255.0 dest_network 10.10.10.0 dest_netmask 255.255.255.0

set advanced-firewall bypass-stateful-firewall-config add source_network 10.10.10.0 source_netmask 255.255.255.0 dest_network 10.10.90.0 dest_netmask 255.255.255.0