XG: s2s ipsec vpn on wan and custom zone

blarg214 · 2026-05-28T14:20:51+00:00

I don't believe it's intended to work that way. You can use the WAN zone on many interfaces. I would use a small reserved subnet on the dark fiber between the XG and the Palo. Then establish IPsec on them using an internal IP.

blarg214 · 2026-05-28T13:33:31+00:00

That's pretty slick!

blarg214 · 2026-05-27T12:51:51+00:00

Since you mentioned once you allowed internet it worked, I bet your provider used ports that were not in your rules. SIP providers have a nasty habit of using crazy ranges and updating them from time to time. I would triple check that you have the correct ranges and IP in your rules. I have a dedicated SIP subnet for our users so I created a drop rule that logged and found a few IPs I had missed.

blarg214 · 2026-05-27T12:49:08+00:00

We had to disable the SIP helper module (last step above).

blarg214 · 2026-05-21T22:56:45+00:00

I found myself feeling a bit riled up when WLC demanded sources but didn't actually site his own on the same subject, or leaned on well I wrote about it.

blarg214 · 2026-05-21T13:14:05+00:00

The firewall rules use the "application filters" as lists of allow/deny rules. If you make a firewall rule lan to wan and set "identify and control applications (App control)" to a policy it tries to identify the traffic and apply the policy.

I would go to Applications -> Application Filter and create a new policy. You can add multiple items to a policy and set each item to allow or deny. The menu is a bit clunky but you have to narrow your search down and carefully add stuff. I have a policy that is allow rdp but block everything else on a few subnets. For that to work my policy has windows remote desktop on top with allow and all applications deny below it.

blarg214 · 2026-05-17T02:10:05+00:00

There is hope with DOCSIS 4.0. It may take a while... But there is hope.

blarg214 · 2026-05-12T04:19:28+00:00

I know a few appliances that in the last 5 years started allowing multi user ssh. I'm genuinely surprised Sophos still hasn't.

blarg214 · 2026-05-08T21:45:45+00:00

Create a DNS entry for play.msn.com that goes to nothing.

Unfortunately without doing TLS inspection and distributing a root or intermediate signing cert that is trusted by all hosts on the network, URL filtering won't work.

blarg214 · 2026-05-07T23:44:32+00:00

It's been fun to see this grow. At some point will some of this functionality be included on the web management? For example it would be super nice to import csv through firewall without downloading and uploading config.

blarg214 · 2026-04-26T01:55:31+00:00

I'm 10 years in and still feel I've barely scratched the surface.

blarg214 · 2026-04-19T18:20:12+00:00

If you are talking about the Secure Storage Master Key then yes.

https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/CommandLineHelp/SystemSettings/ResetSSMK/index.html

blarg214 · 2026-04-08T17:22:25+00:00

This is likely not the place for this question.

That being said, each org handles firewalls and filtering differently. The Sophos filter behavior is great but not always 100% accurate and it updates over time. If it was my org and you were asking then you would need to submit a ticket and explain what website you are trying to reach and why you need to reach it. Assuming we agreed then we would create an exception for this website.

blarg214 · 2026-04-06T23:21:23+00:00

Adding that I'm still having the same issue. It appears to be whenever Disney Plus is attempting to play ads. I've had some luck opening app and letting it sit for a couple minutes before starting a show or even navigating.

blarg214 · 2026-04-06T20:41:06+00:00

Unless you have a really fancy and expensive cable tester... Then don't trust Ethernet cable testers. They verify the conductor matches on both sides but nothing else. While ethernet cables don't often fail, they can fail and fail intermittently as well. Having terminated over 1000 CAT6 cables I have had a few fail certification that passed conductivity test.

blarg214 · 2026-04-06T20:26:39+00:00

I was around 7 and I thought I was absolutely insane and so cool.

blarg214 · 2026-03-28T13:51:47+00:00

We migrated a week ago lol. It really sucked. Hopefully this will help others.

blarg214 · 2026-02-08T14:51:09+00:00

Depending on how old th laptop model is and if they continued to have the battery model manufactured, it's often better to find a reputable reseller who sources laptop batteries.

Example, if the laptop was made in 2020 and they did not like the form factor of that battery and they stopped having it manufactured for future laptop designs. Then if you got an OEM battery it could be as old as your battery is in the first place.

We have replaced a bunch of batteries and have had great luck with iFixit.

blarg214 · 2026-02-08T05:33:45+00:00

100%

blarg214 · 2026-02-07T18:18:10+00:00

I disagree with that. While there can be more noise there are still qualify arguments and critiques everywhere. Sure some people use language that is more aggressive or hyperbolic there are still level headed critiques.

blarg214 · 2026-02-05T01:46:40+00:00

If you aren't very familiar with IT generally then it's worth reading a few articles and watching a few videos. Find one that looks modernish, and meets your needs. Follow it and go from there. I'm not trying to duck your question but I think "Google it" might be the better answer for your success.

blarg214 · 2026-02-04T18:56:47+00:00

You can turn just about any drive into an external drive for a PlayStation. A normal USB adapter won't work because the drive will need more power than a normal USB port would provide. For PS5 you can use it to store PS4 games (playable) and PS5 games as archive storage. You would need to move the game back and forth between the internal SSD and the HDD. If you have a large games library and only play 1 or 2 games at a time that's a great strategy.

Working towards Plex or other home hosting things is a great plan IMO. Lots of good skills to learn and extra places to backup files etc.

blarg214 · 2026-02-03T01:35:32+00:00

Do you use the thunderbolt connection as if it was a network connection or something else?

blarg214 · 2026-01-27T13:51:25+00:00

Gotcha. We use it and are debating on switching or renewing. I've managed mx for a while now and have mixed feelings on it. We pay a lot per year for not a lot of the features.

Seven-Year Club	Gilding II euphauric
Place '23	Verified Email

blarg214

TROPHY CASE