Web Application Firewall - Real webserver "in error"

thenetstriker · 01-09-2013, 03:03 PM

I' am trying to setup an Web Application Firewall on my Sophos UTM 9. I've configured some real webservers and one virtual webserver. In the virtual webserver on the left always appears an icon that says "in error". I get nothing in the logs. What could cause this problem?

BAlfson · 01-09-2013, 04:39 PM

Please [Go Advanced] below and attach a picture of the Edit of your Virtual Server.

Cheers - Bob

thenetstriker · 01-10-2013, 09:41 AM

Here is the picture of my configuration.

BAlfson · 01-10-2013, 04:17 PM

You haven't selected a 'Firewall profile'. Is there a reason you're using the IP instead of an actual FQDN in 'Domains'.

Cheers - Bob

thenetstriker · 01-10-2013, 06:38 PM

I've also tried it with firewall profile and it did not work either. I've entered the ip because I want to test this function first before I use it in production.

BAlfson · 01-10-2013, 06:56 PM

Just go ahead and use the actual domain and select the "Basic Protection" firewall. There's no danger in experimenting with a production server as you're using the internal interface and port 5555.

Any luck?

Cheers - Bob

BrucekConvergent · 01-10-2013, 07:09 PM

Is the "real" server actually up and able to serve pages? what does the WAF log show?

thenetstriker · 12:30 PM

I've now selected the "Basic Protection" profile and entered the www address of my Filewall and switched to the external interface, but is still doesn't work. The "Web Application Firewall" log is 0 bytes. The UBUNTU webserver does work. I've also tried to forward to my Windows IIS Server, but that didn't work either. It is weired that nothing is logged. Should not at least the start of the Web Application Firewall appear in the log?

BAlfson · 06:35 PM

To use the External interface from inside the "Internal (Network)", you would need a Full NAT (Accessing Internal or DMZ Webserver from Internal Network). On second thought, I don't believe this would work at all to get traffic to the WAF - I think you have to use the approach with the Internal interface if accessing from the Internal network.

It will be easier and a better test to use the Internal interface and create a DNS entry for the FQDN pointing at the IP of "Internal (Address)".

Cheers - Bob

BrucekConvergent · 01-11-2013, 06:25 PM

Do you have any NAT rules configured that may conflict with this?

Astaro Security Gateway

Network Security

Web Security

Web Application Security

Mail Security

Information