Mozilla Firefox Trouble with Google Gmail web based access

Have just installed Intercept X.  Now I have same issue.

Was using on-premises Endpoint before, but changed because pestered by reseller about end-of-life etc. I am a sole end user, not a sysadmin.

On starting Firefox, all google domains (google.com, google.co.uk, news.google.com etc) are initially accessible. But after about 5 minutes, they all fail.  Links on the previously opened search pages also fail.

Restarting Firefox restores access. But then it fails again after about 5 minutes.

No problems in Edge or Chrome.

Surprised to read above that some users have had the issue for months. Do Sophos just not care?

I must say, that it works fine for me and I've been trying to reproduce this.

FF 99.0.1

The following Sophos component versions:

I'm running Windows 11:

I've tried with and without HTTPS inspection.

It all just works fine.  If you use open the Firefox Developer tools on the Network tab, can you capture the issue?

I have exactly the same components as above, but Windows 10 Pro.

On the most recent attempt, news.google.com failed first. google.co.uk stayed for longer, but failed after about 30 mins.

I don't know what I'm looking for in Developer Tools. I "saved all as HAR", but this website won't let me upload that file. 

The fault seems intermittent but frequent. 


2204 hrs Unable to access google sites

2207 hrs working again (without browser restart)

2215 hrs failed again

This is the Developer Tools Timings :

Can you see requests failing in the "Network" view when there is an issue? Are the failures from the same Domain for example?

Typing google.co.uk into the Firefox browser bar, the Network tab shows nil transferred:

Typing in news.google.com, same result:

But typing in google.com, it works:

Google.co.uk is the local domain for searches giving greater priority to UK results. Maybe other people are not getting the fault because not using this. But everyone needs to use news.google.com?

Typing google.co.uk into the Firefox browser bar, the Network tab shows nil transferred:

Typing in news.google.com, same result:

But typing in google.com, it works:

Google.co.uk is the local domain for searches giving greater priority to UK results. Maybe other people are not getting the fault because not using this. But everyone needs to use news.google.com?

An hour later (no intervening browser restart):

google.co.uk into the Firefox browser works
google.com doesn't work

I.e. the opposite of the original problem. ??

News.google.com still not working.

This seems very occult. But it's also useless. Trouble-free  access to google sites is not an esoteric requirement. 

Do you think you could catch it with Debug logging enabled. If you open Endpoint Self Help

This sets the DWORD named LogLevel to 0 under:

HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Logging\NTP\SophosNetFilter.exe

it seems from a Process Monitor log.

In a PS prompt you could tail the log file which should now have debugging enabled. I.e. there will be "D" references in the log file before the messages at this level.

gc "C:\Programdata\Sophos\Sophos Network Threat Protection\logs\SophosNetFilter.log" -wait -tail 1

From the broken state, if you "hard" refresh the page, is there any useful error message if Firefox still errors?

If you still have the browser developer tools open, I suppose you could try checking "Disable cache" option.  Just to be sure any error page is not a cached message in some way although it seems odd to cache an error message.

On a minority (maybe 25%) of the failed connections to google sites, I get this (probably uninformative?) error message in the browser window

I tried doing the Debug Logging thing, but I get "Access Denied" in Powershell (after I figured out what "PS" was)

I'm not knowledgeable about any of this. I'm a solo end user (one man company), not a sysadmin.

Looking around this forum, there have been reports of this bug  (under various headings) for several months. 

Thanks for your suggestions. But I think it's going to take someone with better knowledge than me to fix this. 

Can you try to set the following flag in firefox? 

1. Enter “about:config” in the address bar and continue to the list of preferences.
2. Set the preference "security.enterprise_roots.enabled" to true.
3. Restart Firefox.

If you've been migrated from the SAV based web protection to the new version, which seems to be the case as your list of components doesn't include Sophos Anti-Virus, then you should have the process SophosNetFilter.exe running which is responsible for web protection and control.  This should create the log file: "SophosNetFilter.log".

With Debug logging on it will grow quite a bit quicker.  I was hoping that for the quick page refresh, tailing the log file with PowerShell then stopping it, once the issue had occurred and then Ctrl-C out of the tail command would given you just the logging needed on screen.

I suppose you could check the file exists.

I set  "security.enterprise_roots.enabled" to true. as suggested above and restarted firefox.

I do have a process SophosNetFilter.exe in Task Manager.

But searching C:\Prgramdata\Sophos\Sophos Network Threat Protection  finds no file "SophosNetFilter.log". If I search from higher up the file path, still no good.

Maybe I don't have the right permissions, I can't view the Programdata\Sophos\Sophos Network Threat Protection folder in file explorer, even as administrator.

Try to restart the PC again (Not shutdown and boot, instead reboot). It should import the certificate. 

Thank you. I seem to have the logging working now. This is the log file for a single click on my Firefox bookmark for google.co.uk (with 0Kb transferred according to Developer Tools):

Sorry that print screen didn't get the start of the log - it's longer than my monitor screen - here it is from the start

That could be Sophos tamper protection at play.

Running PowerShell as administrator and running the command:

gc "C:\Programdata\Sophos\Sophos Network Threat Protection\logs\SophosNetFilter.log" -wait -tail 1

should work but you could try running the following sequence of commands in that admin PowrerShell prompt to see how far you get along the path, i.e.:

CD \

CD Programdata

CD Sophos

CD Sophos Network Threat Protection

CD Logs

dir

Can you see the logs?

In other news, I did get:

and then....

The scenario being;

1. Launch Firefox, type something in the address bar to perform a search.  I switched the default search engine to DuckDuckGo just to see if Google was even significant. This worked all is fine and I can repeat this. All OK.

2. Tamper Protection is off so I restart the service:

"Sophos Network Threat Protection"

This will essentially exit and re-launch the SophosNetFilter.exe process which is used for Web Protection/Control.

3. If I refresh the page, then I get the above error.

So I wonder if, for some reason, the SophosNetFilter.exe process is restarting on your computer?

To test this theory, if you open Windows Task Manager, under the Details tab find the SophosNetFilter.exe process when all is working, make a note of the PID (process id).  Browse away, until you get the issue.  Has the PID of the SophosNetFilter.exe changed?

---

In the SophosNetFilter.log (with Debug logging enabled), I see:

022-05-01T11:02:44.096Z [36128:65640] D Server Hello SNI lookup: duckduckgo.com - allow: true
2022-05-01T11:02:44.097Z [36128:94500] E SSL_do_handshake returned SSL error= 1 reason=1042 error:00000001:lib(0):func(0):reason(1) SSL*=00000185B8682460
2022-05-01T11:02:44.103Z [36128:94500] E Failed to set up SSL MITM encryption: Unrecoverable SSL error during handshake(): error:00000412:lib(0):func(0):reason(1042)
2022-05-01T11:02:44.104Z [36128:94500] E Unrecoverable SSL error in input() flowId=87351 side=0 size=24 offset=0
2022-05-01T11:02:44.106Z [36128:94500] D request disconnect flowId=87351 side=0 flags=65536

---

This made me think of the 5 minute comments. In the current product, when you boot the computer, 5 mins after the Sophos AutoUpdate Service starts (alsvc.exe), the first update occurs, then it goes back to the 1/hr check if all is well.

If however, there is an issue with a component installing and there has never been a successful update, such that the FeatureHash value under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\AutoUpdate is not stored, as there is yet to be a successful update.  Then the AutoUpdate product runs the setup plugins of all the components including AutoUpdate, this has the effect of restarting the AutoUpdate service and it enters into a 5 minute update.  

If this is the case, under C:\windows\temp\ there are installer logs of Sophos being created every 5 minutes?

I'm just trying to think of a scenario where the SophosNetFilter.exe process is constantly being restarted, and if the NTP component is being re-installed every 5 mins by AutoUpdate that could be one.

---

Interestingly and somewhat expectedly, if I disable in policy:

Which can be seen at the endpoint:

HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Management\Policy\ThreatProtection\[policyrevision]\web_protection

https_decrypt_enabled = 0

Then if the process is restarted as above, it all works.

Hopefully you find that for some reason, the SophosNetFilter.exe process is restarting.  We can then focus on that.