Sophos XG Firewall Web Interface Reference and Admin Guide v16.5

Rule ID

Specify ID for the rule.

User

Select a user from the list of already existing users.

Connection ID

Specify a connection ID.

Clear

Click to remove the filter settings.

| Monitor and Analyze | 45

Figure 24: Display Filter

3. Click Save.

Connection List

This page provides a current or live connection snapshot of your device in list form. Apart from the connection details, the list also provides information like firewall rule ID, user ID, and connection ID per connection. It is

| Monitor and Analyze | 46 possible to filter the connection list as per the requirement. Click the Connection ID hyperlink to view the live snapshot of a specific connection in a new window.

The administrator can set the refresh interval to automatically refresh the list at the configured time interval or

manually refresh the list by clicking the Refresh button. To filter the connection list click the

Display Filter

and

specify the parameters.

Connection List

Time

Connection establishment time in the format HH:MM:SS.

Connection ID

Unique ID assigned to a connection.

In Interface

Port used for the incoming connection.

Out Interface

Port used by the outgoing connection.

Source IP

Source IP address (IPV4/IPv6) of the connection.

Destination IP

Destination IP address (IPV4/IPv6) of the connection.

Protocol

Protocol used by the connection, like TCP or UDP.

Application Name

Name of the application that has opened the connection.

Name is displayed for the applications identified by SF-OS. If Security Heartbeat is enabled under

Protect > Advanced Threat > Security Heartbeat then for applications that remain unidentified,

Resolve Application Info link is displayed. Click the link to retrieve application information from the Endpoint.

If Security Heartbeat is not enabled or Endpoint devices are not connected, then No Information

Available is displayed.

Source Port

Source port of the connection.

Destination Port

Destination port of the connection.

Master Connection ID

Master connection ID of the current connection.

Rule ID

Firewall rule ID that allows the session.

Username

Name of the user establishing a connection.

Connection Status

Displays the status of the connection.

Flags

User Group

System flag

User group membership.

Web Filter ID

Web filter policy ID applied on the connection traffic.

Application Filter ID

Application filter policy ID applied on the connection traffic.

IPS Policy ID

IPS policy ID applied on the connection traffic.

Traffic Shaping Policy ID

QoS policy ID applied on the connection traffic.

Remote Access Policy ID

Remote access policy ID applied on the connection traffic.

Gateway ID

Gateway ID through which the connection traffic is routed.

Web Category ID

Web category ID applied on the connection traffic.

Application ID

Application ID applied on the connection traffic.

Application Category ID

Application category ID applied on the connection traffic.

Connection Served By

Device serving the connection.

Translated Source

Translated source IP Address for outgoing traffic.

Translated Destination

Translated source IP Address for outgoing traffic.

Expiry (second)

Connection will expire in displayed seconds if idle.

Rx Bytes

The amount of data in bytes received in this session.

Tx Bytes

The amount of data in bytes sent in this session.

Rx Packets

Number of packets received in this session.

Tx Packets

Number of packets sent in this session.

Connection State

Displays state of connection.

| Monitor and Analyze | 47

Figure 25: Connection List

Display Filter

Use Display Filter page to set filtering criteria for displaying the connection list.

1. Go to Monitor & Analyze > Diagnostics > Connection List and click Display Filter.

2. Enter filter parameters

In Interface

Interface used by the incoming connection.

Out Interface

Interface used by the outgoing connection.

User

Name of the user establishing a connection.

Network Protocol

Select the network protocol used to establish a connection.

Available Options:IPv4IPv6

Source IP

IP address (IPv4/IPv6) from which the connection was established.

Destination IP

IP address (IPv4/IPv6) on which connection is established.

Packet Type

Select the type of packet used for the connection.

Source Port

Source port of the connection.

Destination Port

Destination port for the connection.

Rule ID

Firewall rule ID.

Clear

Click to remove the filter settings.

| Monitor and Analyze | 48