Sophos XGS does not working with XG Module

[ccesario]

Hi Team,

When I configure the Sophos XGS to sent syslog to UTMStack Collector, the log is identified as generic intead firewall-xg-*.

Could someone know has idea about it ? The UTMStack XG collector is it compatible with Sophos XGS devices?

Regards
Carlos

[securemeit]

Native Mode is not supported.

You need to switch to Legacy Mode.

I have already made a feature request to support native mode 2 years ago.

[ccesario]

Hello @secureme71, thanks for clarify.

But even using native mode with XGS V21 it does not work as expected.

Regards
Carlos

[securemeit]

You cannot use native mode. You need to use legacy mode.

[ccesario]

Hi @secureme71, sorry by mistake, I meant "legacy mode".

Regards
Carlos

[securemeit]

Strange. I have many Sophos XGS with latest build without any issue.

You can see the image for reference.

[ccesario]

Yes, it the same tha Im using in both XG (EOL by Sophos) and the new device XGS. :(

[securemeit]

Hi Carlos,

if your setting is the same (Secure log transmission is not ticked) of the screenshot, I think you have an issue with UTMStack agent. You need to check the logs and services related to UTMStack Agent.

For example you must see entries like this "xxxxxx logs from firewall_sophos have been processed" in /opt/utmstack-linux-agent/logs_process

systemctl | grep UTMStack

UTMStackAgent.service loaded active running UTMStack Agent Service
UTMStackModulesLogsCollector.service loaded active running UTMStackModulesLogsCollector

Best regards

Walter

[ccesario]

Hi Walter,
Yes I can see the log form others XG devices.... and other collectors. Bot no log from XGS :)

Regards
Carlos

[securemeit]

Hi Carlos,

if you make tcpdump on UTMStack, which type of dump you can see when the source ip is XGS and destination port is 7008?

Do you see these type of messages or not (I have deleted first part)?

Do you have release of XGS 21.x?

Best regards

Walter

[ccesario]

Hi @secureme71,

Yes I see ...

And, yes Im using XGS 21.x :-)

Regards
Carlos