Mozilla Firefox Trouble with Google Gmail web based access

Have just installed Intercept X.  Now I have same issue.

Was using on-premises Endpoint before, but changed because pestered by reseller about end-of-life etc. I am a sole end user, not a sysadmin.

On starting Firefox, all google domains (google.com, google.co.uk, news.google.com etc) are initially accessible. But after about 5 minutes, they all fail.  Links on the previously opened search pages also fail.

Restarting Firefox restores access. But then it fails again after about 5 minutes.

No problems in Edge or Chrome.

Surprised to read above that some users have had the issue for months. Do Sophos just not care?

I must say, that it works fine for me and I've been trying to reproduce this.

FF 99.0.1

The following Sophos component versions:

I'm running Windows 11:

I've tried with and without HTTPS inspection.

It all just works fine.  If you use open the Firefox Developer tools on the Network tab, can you capture the issue?

I have exactly the same components as above, but Windows 10 Pro.

On the most recent attempt, news.google.com failed first. google.co.uk stayed for longer, but failed after about 30 mins.

I don't know what I'm looking for in Developer Tools. I "saved all as HAR", but this website won't let me upload that file. 

I have exactly the same components as above, but Windows 10 Pro.

On the most recent attempt, news.google.com failed first. google.co.uk stayed for longer, but failed after about 30 mins.

I don't know what I'm looking for in Developer Tools. I "saved all as HAR", but this website won't let me upload that file. 

The fault seems intermittent but frequent. 


2204 hrs Unable to access google sites

2207 hrs working again (without browser restart)

2215 hrs failed again

This is the Developer Tools Timings :

Can you see requests failing in the "Network" view when there is an issue? Are the failures from the same Domain for example?

Typing google.co.uk into the Firefox browser bar, the Network tab shows nil transferred:

Typing in news.google.com, same result:

But typing in google.com, it works:

Google.co.uk is the local domain for searches giving greater priority to UK results. Maybe other people are not getting the fault because not using this. But everyone needs to use news.google.com?

An hour later (no intervening browser restart):

google.co.uk into the Firefox browser works
google.com doesn't work

I.e. the opposite of the original problem. ??

News.google.com still not working.

This seems very occult. But it's also useless. Trouble-free  access to google sites is not an esoteric requirement. 

Do you think you could catch it with Debug logging enabled. If you open Endpoint Self Help

This sets the DWORD named LogLevel to 0 under:

HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Logging\NTP\SophosNetFilter.exe

it seems from a Process Monitor log.

In a PS prompt you could tail the log file which should now have debugging enabled. I.e. there will be "D" references in the log file before the messages at this level.

gc "C:\Programdata\Sophos\Sophos Network Threat Protection\logs\SophosNetFilter.log" -wait -tail 1

From the broken state, if you "hard" refresh the page, is there any useful error message if Firefox still errors?

If you still have the browser developer tools open, I suppose you could try checking "Disable cache" option.  Just to be sure any error page is not a cached message in some way although it seems odd to cache an error message.

On a minority (maybe 25%) of the failed connections to google sites, I get this (probably uninformative?) error message in the browser window

I tried doing the Debug Logging thing, but I get "Access Denied" in Powershell (after I figured out what "PS" was)

I'm not knowledgeable about any of this. I'm a solo end user (one man company), not a sysadmin.

Looking around this forum, there have been reports of this bug  (under various headings) for several months. 

Thanks for your suggestions. But I think it's going to take someone with better knowledge than me to fix this. 

Can you try to set the following flag in firefox? 

1. Enter “about:config” in the address bar and continue to the list of preferences.
2. Set the preference "security.enterprise_roots.enabled" to true.
3. Restart Firefox.

If you've been migrated from the SAV based web protection to the new version, which seems to be the case as your list of components doesn't include Sophos Anti-Virus, then you should have the process SophosNetFilter.exe running which is responsible for web protection and control.  This should create the log file: "SophosNetFilter.log".

With Debug logging on it will grow quite a bit quicker.  I was hoping that for the quick page refresh, tailing the log file with PowerShell then stopping it, once the issue had occurred and then Ctrl-C out of the tail command would given you just the logging needed on screen.

I suppose you could check the file exists.

I set  "security.enterprise_roots.enabled" to true. as suggested above and restarted firefox.

I do have a process SophosNetFilter.exe in Task Manager.

But searching C:\Prgramdata\Sophos\Sophos Network Threat Protection  finds no file "SophosNetFilter.log". If I search from higher up the file path, still no good.

Maybe I don't have the right permissions, I can't view the Programdata\Sophos\Sophos Network Threat Protection folder in file explorer, even as administrator.

Try to restart the PC again (Not shutdown and boot, instead reboot). It should import the certificate.