DNS Traffic Recognized as App-ID "sophos-live-protection"

9958

Created On 02/09/21 16:35 PM - Last Modified 07/03/24 04:19 AM

Applications

Security Policy

App-ID

8.1

9.0

9.1

10.0

Prisma Access

PAN-OS

Symptom

Firewall /Prisma Access is configured to allow only DNS traffic on UPD port 53
Firewall/Prisma Access is dropping other traffic on UDP port 53 with application sophos-live-protection
Packet capture of the DNS traffic categorized by the firewall as sophos-live-traffic shows a DNS query for sophosxl.net

The app identification is expected behaviour since the client is generating queries with a specific data in them.
If Sophos endpoints are used in the network, Create appropriate policies to allow sophos-live-protection application.

Resolutions for this issue would be one of the listed three options:

Disable Sophos Applications from all hosts (internal DNS server in this case) if company intention is to not have endpoints use this application and make sure that the uninstallation was properly done.
Include sophos-live-protection in the Allow DNS Security Policy Rule.
If using internal DNS server and server is configured to re-use same source ports, change the server to use different source ports for each query so that the firewall will not match non-Sophos traffic incorrectly as sophos-live-protection.

See Sophos website below for more information on SXL
https://support.sophos.com/support/s/article/KB-000034570?language=en_US