-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
Syslog messages to GMS blocked by Application Control Advanced
03/26/2020 
5 People found this article helpful
487,006 Views
Description
Syslog messages to GMS blocked by Application Control Advanced
Resolution
Problem Definition:
Encrypted Syslog traffic sent by a SonicWall UTM appliance to a GMS sever is blocked by App Control Advanced as PROXY-ACCESS Encrypted Key Exchange -- UDP Random Encryption(UltraSurf), SID: 7, AppID: 2900, CatID: 27.
Resolution or Workaround:
App Control Advanced Signature ID 7, introduced in SonicOS 5.8.1.8-57o, identifies encrypted UDP packets and, if enabled, blocks it. This signature is intended to block proxy applications that try to bypass firewall detection. Encrypted Syslog messages coming from a SonicWall UTM appliance to a GMS server / appliance could be falsely identified as coming from a proxy application and blocked.
The following workaround could be applied to allow such Syslog traffic:
1. Add the GMS server/appliance IP address to the Exclusion List of App Control Advanced.
2. Exclude the GMS server/appliance IP address from SID 7 (PROXY-ACCESS Encrypted Key Exchange UDP Random Encryption(UltraSurf), SID)CatID: 27.
Procedure
Create an Address Object for the GMS server IP under Network > Address Objects page
To add the GMS server/appliance IP address to the Exclusion List of App Control Advanced.
To exclude the GMS server/appliance IP address from SID 7
To add the GMS server/appliance IP address to the Exclusion List of App Control Advanced.
- Navigate to the Firewall > App Control Advanced page.
- Click on the Configure App Control Settings button.
- In the App Control Config View pop-up window, enable check box Enable App Control Exclusion List
- Select radio button Use Application Control Exclusion Address Object.
- Select the earlier created Address Object of the GMS server from the drop-down list.
- Click on OK to save.
To exclude the GMS server/appliance IP address from SID 7
- In the Firewall > App Control Advanced page, enter 7 under Lookup Signature ID and click on the configure button.
- In the Edit App Control Signature window, select the address object of the GMS server IP address under Excluded IP Address Range.
- Click on OK to save.
Related Articles
- How to Block Google QUIC Protocol on SonicOSX 7.0?
- How to block certain Keywords on SonicOSX 7.0?
- How internal Interfaces can obtain Global IPv6 Addresses using DHCPv6 Prefix Delegation
Categories
- Firewalls > TZ Series
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall NSA Series
YES
NO