Sophos Firewall traffic investigation cheat sheet
Use log filters to connect a connection failure with firewall decisions.
Sophos Firewall SFOS web admin console; labels vary by version.
Updated · Sophos · 7 min read
| Console path | What it does |
|---|---|
Log viewer → Firewall | Open firewall traffic logs |
Filter source IP, destination IP and destination port | Isolate a traffic flow |
Inspect action, rule ID and reason | Read the firewall decision |
Compare with VPN and system events | Correlate adjacent failures |
Walkthrough
Use a read-capable administrator account and a known source, destination and incident time. Availability of traffic records depends on rule logging.
Step 1: Open firewall traffic logs
Log viewer → Firewall
Set the time window for the reported failure. Confirm that the relevant firewall rule is configured to log traffic before treating an empty log as evidence of no traffic.
Step 2: Isolate a traffic flow
Filter source IP, destination IP and destination port
Use the translated and original addresses as appropriate to the scenario. Match the exact protocol and port; ping is not a substitute for an application flow.
Step 3: Read the firewall decision
Inspect action, rule ID and reason
Record the matching rule and drop reason. An allow record shows a policy decision at this device, not successful application authentication or the return route.
Step 4: Correlate adjacent failures
Compare with VPN and system events
If the destination is across a VPN, compare tunnel events and route state at the same timestamp. Preserve findings before proposing a scoped change.