Diagnostics. Sophos v16.5
Reklama
Reklama
Sophos XG Firewall | Monitor and Analyze | 28
The page displays a list of all the currently logged remote users and you can filter the connections based on the connection date, username, source IP address, or leased IP address.
The administrator can disconnect any of the remote users, if required, by clicking Disconnect.
Related Topics
Add SSL VPN Remote Access Policy
This page allows adding SSL VPN remote access policies.
Diagnostics
This menu allows checking the health of your device in a single shot. Information can be used for troubleshooting and diagnosing problems found in your device.
Use this menu to configure below details:
•
- View the statistics to diagnose the connectivity problem, network problem and test network
communication. It assists in troubleshooting issues such as hangs, packet loss, connectivity, discrepancies in the network. Also, troubleshooting reports can be generated to debug system problems.
•
- Use to view graphs pertaining to the system related activities for different time intervals.
•
- Use to search whether the URL is categorized or not.
•
- Displays packets details on the specified interface.
•
- Provides current or live connection snapshot of your device in the list form.
•
- Use this page to grant support staff temporary access to your device.
Tools
Using the Tools page, one can view the statistics to diagnose the connectivity problem, network problem and test network communication. It assists in troubleshooting issues such as hangs, packet loss, connectivity, discrepancies in the network. The page covers:
•
•
•
•
•
Consolidated Troubleshooting Report
Ping
Ping is the most common network administration utility used to test the reachability of a host on an Internet Protocol
(IP) network and to measure the round-trip time for messages sent from the originating host to a destination computer.
Ping sends ICMP echo request/replies to test the connectivity to other hosts. Use standard ICMP ping to confirm that the server is responding. Ping confirms that the server can respond to an ICMP ping request.
Use Ping diagnostically to:
• Ensure that a host computer you are trying to reach is actually operating or the address is reachable or not
• Check how long it takes to get a response
• Get the IP address from the domain name
• Check for the packet loss
The parameters used are:
IP Address/Host Name
Specify the IP address (IPv4/IPv6) or fully qualified domain name to be pinged.
Sophos XG Firewall | Monitor and Analyze | 29
IP Family
Select the type of IP family from the options available:
Available OptionsIPv4IPv6
Interface
Ping determines the network connection between the device and a host on the network. The output shows if the response was received, packets transmitted and received, packet loss if any and the round-trip time. If a host is not responding, ping displays 100% packet loss.
Select the interface through which the ICMP echo requests are to be sent.
Size
Specify the ping packet size, in bytes.
Default: 32 bytes
Size Range: 1 to 65507
Figure 7: Ping
Traceroute
Traceroute is a useful tool to determine if a packet or communication stream is being stopped at the device, or is lost on the Internet by tracing the path taken by a packet from the source system to the destination system, over the
Internet.
Use Traceroute to:
• find any discrepancies in the network or the ISP network within milliseconds.
• trace the path taken by a packet from the source system to the destination system, over the Internet.
The parameters used are:
IP Address/Host Name
Specify the IP address (IPv4/IPv6) or fully qualified domain name.
Traceroute determines the network connection between the device and a host on the network. The output shows all the routers through which data packets pass on way from the source system to the destination system, maximum hops and total time taken by the packet to return measured in milliseconds.
IP Family
Select the type of IP family from the options available:
Available OptionsIPv4IPv6
Interface
Select the interface through which the requests are to be sent.
Sophos XG Firewall | Monitor and Analyze | 30
Figure 8: Traceroute
Name Lookup
Name Lookup is used to query the domain name service for information about domain names and IP addresses. It sends a domain name query packet to a configured domain name system (DNS) server. If a domain name is entered, the return is an IP address to which it corresponds, and if an IP address is entered, then the domain name is returned to which it corresponds. In other words, Name Lookup reaches out over the Internet to do a DNS lookup from an authorized name server, and displays the information in user understandable format.
The parameters used and their descriptions are:
IP Address/Host Name
IP address (IPv4/IPv6) or fully qualified domain name that needs to be resolved.
DNS Server IP
Select the DNS server to which the query is to be sent.
Select Lookup using all Configured Servers to view all the available DNS servers configured in the device. Selecting this option will also provide information about the time taken by each DNS sever to resolve the query. Based on the response time,of each server, you can prioritize the DNS server.
Figure 9: Name Lookup
Route Lookup
If you have routable networks and wish to search through which interface the device routes the traffic then lookup the route for the IP address (IPv4/IPv6).
Figure 10: Route Lookup
Sophos XG Firewall | Monitor and Analyze | 31
Consolidated Troubleshooting Report
To help the Support team to debug the system problems, a troubleshooting report can be generated which consists of the system’s current status file and log files. The file contains details like a list of all the processes currently running on the system, resource usage etc. in encrypted form.
The administrator has to generate and mail the saved file to Support for diagnosing and troubleshooting the issue.
The file will be generated with the name: CTR_<APPKEY>__<MM_DD_YY>_<HH_MM_SS> where
• APPKEY is the device key of the device for which the report is generated
• MM_DD_YY is the date (month date year) on which the report is generated
• HH_MM_SS is the time (hour minute second) at which the report is generated
By default, the debug mode is off for all the subsystems. Before generating a log file, enable the debug mode by executing following command at the command line: console> diagnostics subsystems <subsystem name> debug on
Note: Debug mode cannot be enabled, if you only want to generate a system snapshot.
The parameters used are:
Generate CTR for
Enable the option(s) for which CTR should be generated.
Available Options:System Snapshot: Generates snapshots to display the issues in the system.Log
Files: Generates log files.
Reason
Specify the reason for generating CTR.
Generate
Click to generate the CTR.
Figure 11: Consolidated Troubleshooting Report
System Graphs
System Graphs page displays graphs pertaining to system related activities for different time intervals.
Monitor & Analyze > Diagnostics > System Graphs
System graphs displays following information for the selected period. These graphs are same as displayed in Utility wise graphs. They are regrouped based on the time interval.
1.
2.
3.
4.
Sophos XG Firewall | Monitor and Analyze | 32
5.
6.
Data transfer through WAN zone
7.
CPU Usage Graphs
CPU Usage graphs enable the administrator to monitor the CPU usage by the users and system components. Graphs display percentage wise minimum, maximum, average and current CPU usage for user, system, and CPU idle time.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – % use
Legend:
• Orange color – CPU used by user
• Purple color – CPU used by system
• Green color – CPU idle time
Figure 12: CPU Usage
Memory Usage Graphs
Memory Usage graphs enable the administrator to monitor the memory usage in Megabytes(MB). Graph displays percentage wise minimum, maximum, average and current memory used, free memory and total memory available.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Memory used in MB
Legend:
• Orange color – Memory used
• Purple color – Free memory
• Green color – Total memory
Sophos XG Firewall | Monitor and Analyze | 33
Figure 13: Memory usage
Load Average Graphs
Load Average graphs enables the administrator to monitor the load on the system.
Graphs display the minimum, maximum, average and current load on the system at the interval of one minute, five minute, and fifteen minutes.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Load average index
Legend:
• Orange color – One minute
• Purple color – Five minutes
• Green color – Fifteen minutes
Figure 14: Load Average
Sophos XG Firewall | Monitor and Analyze | 34
Disk Usage Graphs
Disk Usage graphs enable the administrator to monitor the disk usage in percentage.
Graphs display the minimum, maximum, average and currently used disk space in percentage by Signatures, Config,
Reports and Temp files.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – % use
Legend
• Orange color – Disk space used by signatures
• Purple color – Disk space used by config files
• Green color – Disk space used by reports
• Blue color – Disk space used by temp
Figure 15: Disk Usage
Live Users Graphs
Live Users graphs enable the administrator to monitor the number of live users for the selected time duration.
Graphs display the number of users currently connected to the Internet. In addition, it shows the minimum, maximum and average number of users connected during the selected period.
This helps the administrator in determining the peak hour of the day.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Numbers of users
Legend
• Orange color – Number of live connected users
Sophos XG Firewall | Monitor and Analyze | 35
Figure 16: Live Users
Data Transfer through WAN Zone Graphs
Data Transfer for WAN zone graphs is subdivided into three (3) graphs providing various information about data transfer via WAN zone.
1. Total upload/download data transfer of the selected period – Graph displays combined graph of upload & download data transfer. Colors differentiate upload & download data traffic. In addition, it shows the minimum, maximum and average data transfer for upload & download traffic individually.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Upload/download in KBits/second
Legend
• Orange Color - Upload traffic
2. Total data transfer of the selected period - Graph displays the total data transfer from the WAN zone. In addition, it shows the minimum, maximum and average data transfer.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Upload/download in KBits/second
Legend
• Orange Color - Total (upload + download) traffic
• Purple Color - Download traffic
3. Gateway wise total data transfer of the selected period - Graph displays the gateway-wise data transfer from the WAN zone. In addition, it shows the minimum, maximum and average data transfer of each gateway.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Upload/download in KBits/second
Legend
• Different color for each gateway
Sophos XG Firewall | Monitor and Analyze | 36
Figure 17: WAN Data Transfer
Interface Info Graphs
Interface Info graph displays following traffic statistics for all the interfaces - physical interfaces, VLAN interfaces, wireless LAN and WAN interfaces:
1. Bits received and transmitted through the interface
2. Errors occurred while transmitting and receiving packets through the interface
3. Packets dropped while transmitting and receiving packets through the interface
4. Collisions occurred while transmitting and receiving packets through the interface
The graph shows
• X-axis – Minutes/hours/days/months (depending on the period selected)
• Y-axis – KBits/sec
Legend
• Orange color – Bits received (kbits/sec)
• Purple color – Bits transmitted (kbits/sec)
• Light Green color – Received Errors (kbits/sec)
• Blue color – Bits transmitted but dropped
• Pink color – Collisions
• Red color – Transmitted errors
• Dark Green color – Bits received but dropped
Sophos XG Firewall | Monitor and Analyze | 37
Figure 18: Interface Graph
Note:
• Today and Yesterday graphs are plotted at the average of 5 minutes.
• Weekly graph is plotted at the average of 15 minutes.
• Monthly graph is plotted at the average of 6 hours
• Yearly graph is plotted at the average of 1 day
URL Category Lookup
Use URL Category Lookup to search whether the URL is categorized or not. It searches the specified URL and displays the category name under which the URL is categorized along with the category description.
If domain/URL is categorized under both a Custom Category and a Default Category, then name of the Custom
Category will be displayed in the search result.
To search a URL:
1. Go to Monitor & Analyze > Diagnostics > URL Category Lookup.
2. Enter URL to be searched in Search URL.
3. Click Search.
Figure 19: URL Category Lookup
Packet Capture
Sophos XG Firewall | Monitor and Analyze | 38
This page displays packets details on the specified interface. It will provide connection details and details of the packets processed by each module packets e.g. firewall, IPS along with information like firewall rule number, user, web and application filter policy number etc. This will help administrators to troubleshoot errant firewall rules.
You can:
•
– Configure filter settings for capturing the packets.
•
– View the packet information.
•
– Specify the filter conditions for the packets.
• Start/Stop – Start and stop packet capturing.
• Refresh – Refresh the list.
• Clear – Clear the details of the packets captured.
Packet Capture
Trace On/Off
Click the slider to enable/disable packet capturing.
The status, the buffer size and buffer used for capturing is displayed:
• Trace On - packet capturing is on.
• Trace Off - packet capturing is off.
• Buffer Size: 2048 KB
• Buffer used: 0 to 2048 KB
Captured packets fill the buffer up to a size of 2048 KB. While packet capturing is on, if the buffer used exceeds the stipulated buffer size, packet capturing stops automatically. In such a case, you would have to clear the buffer for further use manually.
Note: Packet capture details are displayed in a new window from
only after enabling packet capture.
Figure 20: Packet Capture
Configure
Click to configure packet capturing feature.
Capture filter can be configured through following parameters:Number of Bytes to Capture(per packet)Wrap Capture Buffer Once FullBPF String
There are various filter conditions for capturing the packets. The BPF string is used for filtering the packet capture. For example, host 192.168.1.2 and port 137.
Captured Packet
The Captured Packet section displays a list of all captured packets. For each packet the list shows:
Time
Packet capture time.
In Interface
Sophos XG Firewall | Monitor and Analyze | 39
Interface from which packet is coming.
Out Interface
Interface to which packet is sent.
Ethernet Type
Ether Type: IPv4 or IPv6 or ARP
Ether Type is a field in an Ethernet frame. It is used to indicate the protocol encapsulated in the
Ethernet frame.
Source IP
Source IP address (IPv4/IPv6) of the packet.
Destination IP
Destination IP address (IPv4/IPv6) of the packet.
Packet Type
Type of packet: ARP request or UDP.
Ports [src, dst]
Source and destination ports.
Rule ID
Firewall rule ID.
Status
Possible Packet Status:
• Incoming: Packets received on WAN or LAN interface.
• Forwarded: Packet forwarded to Out Interface.
• Consumed: Packets designated for or used by the device .
• Generated: Packets generated by the device.
• Violation: In case of any policy violation, the device will drop the packet and show the status
Violation.
Reason
Reason for a packet being dropped, if it is dropped.
Connection Status
Displays state of connection.
Served By
Specifies if connection is Established, TIME_WAIT or NONE.
Web Filter ID
Web filter policy ID applied on the connection traffic.
Connection Flags
System flags
Application ID
Application ID applied on the connection traffic.
Application Category ID
Application category ID applied on the connection traffic.
Connection ID
Unique ID assigned to a connection.
Gateway ID
Gateway ID through which the connection traffic is routed.
Sophos XG Firewall | Monitor and Analyze | 40
Remote Access Policy ID
Remote Access policy ID applied on the connection traffic.
Bandwidth Policy ID
Bandwidth policy ID applied on the connection traffic.
User Group
User group membership.
IPS Policy ID
IPS policy ID applied on the connection traffic.
Application Filter ID
Application filter policy ID applied on the connection traffic.
Web Category ID
Web category ID applied on the connection traffic.
Master Connection ID
Master connection ID of current connection.
Username
Name of the user establishing connection.
Display Filter
Click to set the filter criteria.
Packet Capture can be filtered as per the following criteria: interface name, ether type, packet type, source IP, source port, destination IP and destination port, reason, status, rule ID, user, and connection ID.
Packet Information
Packet Information
Packet information including header details and entities including firewall rules & policies.
Figure 21: Packet Information
Hex & ASCII Detail
Hex & ASCII Detail
Packet Information in Hex & ASCII values.
Figure 22: HEX And ASCII Details
Configuring Capture Filter
The Configuring Capture Filter page allows configuration of number of bytes to be captured per packet.
Sophos XG Firewall | Monitor and Analyze | 41
1. Go to Monitor & Analyze > Diagnostics > Packet Capture and click Configure.
2. Enter details to configure the capture filter.
Number of Bytes To Capture (Per Packet)
Specify the number of bytes to be captured per packet.
Wrap Capture Buffer Once Full
Enable to continue capturing the packets even after the buffer is full.
When the checkbox is enabled, the packet capturing starts again from the beginning of the buffer.
Enter BPF String
Specify a BPF string.
BPF (Berkeley Packet Filter) sits between link-level driver and the user space. BPF is protocol independent and use a filter-before-buffering approach. It includes a machine abstraction to make the filtering efficient. For example, host 192.168.1.2 and port 137.
Refer to BPF String Parameters for filtering specific packets.
BPF String Parameters
How to check packets of the
specific host specific source host specific destination host specific network specific source network specific destination network specific port specific source port specific destination port specific host for the particular port the specific host for all the ports except SSH specific protocol
Example
host 10.10.10.1
src host 10.10.10.1
dst host 10.10.10.1
net 10.10.10.0
src net 10.10.10.0
dst net 10.10.10.0
Port 20 or port 21 src port 21 dst port 21 host 10.10.10.1 and port 21 host 10.10.10.1 and port not 22 proto ICMP, proto UDP , proto TCP
Figure 23: Configure Packet
3. Click Save.
Sophos XG Firewall | Monitor and Analyze | 42
Display Filter
This page restricts the packet capturing to specific types of packets. There are further filtering conditions such as the type of interface, ether type, source IP address & destination IP Address.
1. Go to Monitor & Analyze > Diagnostics > Packet Capture and click Display Filter.
2. Enter details to configure the display filter
Interface Name
From the list, select the physical interface used for filtering packets logs.
Ethernet Type
Select the Ethernet type: IPv4 or IPv6 or ARP.
Ethernet Type is a field in an Ethernet frame. It is used to indicate the protocol encapsulated in the
Ethernet frame.
Packet Type
From the list, select the packet type used for filtering packets.
Source IP
Specify source IP address (IPv4/IPv6).
Source Port
Specify source port number.
Destination IP
Specify destination IP address (IPv4/IPv6).
Destination Port
Specify destination port number.
Reason
Select the reason to display the filter from the available options.
Available
Options:FirewallLOCAL_ACLDOS_ATTACKINVALID_TRAFFICINVALID_FRAGMENTED_TRAFFICICMP_REDIRECTSOURCE_ROUTED_PACKETFRAGMENTED_TRAFFICAPPLICATION
FILTERUSER_IDENTITYIPSMAC_FILTERIPMAC_FILTERIP_SPOOFNEIGHBOR_POISONINGSSL_VPN_ACL_VIOLATIONVIRTUAL_HOSTICMP_ERROR_MESSAGE
Status
Select the status of the filter from available options.
Available Options:AllowedViolationConsumedGeneratedIncomingForwarded
Rule ID
Specify ID for the rule.
User
Select a user from the list of already existing users.
Connection ID
Specify a connection ID.
Clear
Click to remove the filter settings.
Sophos XG Firewall | Monitor and Analyze | 43
Figure 24: Display Filter
3. Click Save.
Connection List
This page provides a current or live connection snapshot of your device in list form. Apart from the connection details, the list also provides information like firewall rule ID, user ID, and connection ID per connection. It is possible to filter the connection list as per the requirement. Click the Connection ID hyperlink to view the live snapshot of a specific connection in a new window.
The administrator can set the refresh interval to automatically refresh the list at the configured time interval or
manually refresh the list by clicking the Refresh button. To filter the connection list click the
specify the parameters.
Connection List
Time
Connection establishment time in the format HH:MM:SS.
Sophos XG Firewall | Monitor and Analyze | 44
Connection ID
Unique ID assigned to a connection.
In Interface
Port used for the incoming connection.
Out Interface
Port used by the outgoing connection.
Source IP
Source IP address (IPV4/IPv6) of the connection.
Destination IP
Destination IP address (IPV4/IPv6) of the connection.
Protocol
Protocol used by the connection, like TCP or UDP.
Application Name
Name of the application that has opened the connection.
Name is displayed for the applications identified by SF-OS. If Security Heartbeat is enabled under
Protect > Advanced Threat > Security Heartbeat then for applications that remain unidentified,
Resolve Application Info link is displayed. Click the link to retrieve application information from the Endpoint.
If Security Heartbeat is not enabled or Endpoint devices are not connected, then No Information
Available is displayed.
Source Port
Source port of the connection.
Destination Port
Destination port of the connection.
Master Connection ID
Master connection ID of the current connection.
Rule ID
Firewall rule ID that allows the session.
Username
Name of the user establishing a connection.
Connection Status
Displays the status of the connection.
Flags
System flag
User Group
User group membership.
Web Filter ID
Web filter policy ID applied on the connection traffic.
Application Filter ID
Application filter policy ID applied on the connection traffic.
IPS Policy ID
IPS policy ID applied on the connection traffic.
Traffic Shaping Policy ID
QoS policy ID applied on the connection traffic.
Remote Access Policy ID
Remote access policy ID applied on the connection traffic.
Gateway ID
Gateway ID through which the connection traffic is routed.
Web Category ID
Web category ID applied on the connection traffic.
Application ID
Application ID applied on the connection traffic.
Application Category ID
Application category ID applied on the connection traffic.
Connection Served By
Device serving the connection.
Translated Source
Translated source IP Address for outgoing traffic.
Translated Destination
Translated source IP Address for outgoing traffic.
Expiry (second)
Connection will expire in displayed seconds if idle.
Rx Bytes
The amount of data in bytes received in this session.
Tx Bytes
The amount of data in bytes sent in this session.
Rx Packets
Number of packets received in this session.
Tx Packets
Number of packets sent in this session.
Connection State
Displays state of connection.
Sophos XG Firewall | Monitor and Analyze | 45
Figure 25: Connection List
Display Filter
Sophos XG Firewall | Monitor and Analyze | 46
Use Display Filter page to set filtering criteria for displaying the connection list.
1. Go to Monitor & Analyze > Diagnostics > Connection List and click Display Filter.
2. Enter filter parameters
In Interface
Interface used by the incoming connection.
Out Interface
Interface used by the outgoing connection.
User
Name of the user establishing a connection.
Network Protocol
Select the network protocol used to establish a connection.
Available Options:IPv4IPv6
Source IP
IP address (IPv4/IPv6) from which the connection was established.
Destination IP
IP address (IPv4/IPv6) on which connection is established.
Packet Type
Select the type of packet used for the connection.
Source Port
Source port of the connection.
Destination Port
Destination port for the connection.
Rule ID
Firewall rule ID.
Clear
Click to remove the filter settings.
Sophos XG Firewall | Monitor and Analyze | 47
Figure 26: Display Filter
Related connections
This page displays the live snapshot of the selected connection. Apart from the connection details, the list also provides information like firewall rule ID, user ID, connection ID, Web Filter ID and so on. for the selected connection.
Support Access
Use the Support Access page to allow Sophos Support to temporarily access your Device.
Support Access enables Sophos Support to connect to the Admin console of your Device without sharing the admin credentials. When the feature is enabled, an Access ID is generated using which the Support can access your device.
The admin needs to convey this ID to the support.
When Support Access is enabled, Support can access your Device over HTTPS on TCP port 22 from the WAN. All connections between the Device and Support are initiated by your Device.
Specify the following:
1. Enable the Support Access on Sophos XG Firewall under Diagnostics > Support Access and click the toggle switch.
2. Confirm the enable message with OK.
3. From the drop-down menu Grant Access for select the time the access is valid.
Stiahnuť
Verejný odkaz bol aktualizovaný
Verejný odkaz na váš chat bol aktualizovaný. You may view and manage your chat links after registration here.
Verejný odkaz na dokument
Reklama
