Server Offline in Live Discover

Hi There, 

Can you confirm if you avail to XDR EAP? Have you already allowed all Sophos domains and ports on your Network?

• The Live Discover online/offline status is controlled by the push server connection - If this fails, the device shows as offline

Kindly confirm as well if this is the first time you perform installation of the endpoint on these servers that shows offline?

I am not using EAP.

Today I added all Domains & Ports to my Firewall as suggested by Sophos. I dont think this is the problem as this is happening to some Servers, if I have a Firewall problem, all my servers would appear offline.

The Servers that are offline are all first time installations.

In the mcsclient.log on the computers in the failure state, do you see any errors around this stage:

2021-03-15T17:37:05.871Z [ 4624: 7972] [v4.13.154.0] INFO Establishing push connection
2021-03-15T17:37:05.875Z [ 4624: 7972] [v4.13.154.0] INFO [push]: [connect] trying server mcs-push-server-eu-west-1.prod.hydra.sophos.com/ps
2021-03-15T17:37:05.875Z [ 4624: 7972] [v4.13.154.0] INFO [push]: [connect] trying direct connection without a proxy
2021-03-15T17:37:05.875Z [ 4624: 7972] [v4.13.154.0] INFO GET mcs-push-server-eu-west-1.prod.hydra.sophos.com:443/ps
2021-03-15T17:37:06.096Z [ 4624: 7972] [v4.13.154.0] INFO 200 : sent=0 rcvd=0 elapsed=220ms
2021-03-15T17:37:06.096Z [ 4624: 7972] [v4.13.154.0] INFO [push]: [connect] using server mcs-push-server-eu-west-1.prod.hydra.sophos.com/ps without a proxy (peer address x.x.x.x)
2021-03-15T17:37:06.102Z [ 4624: 7972] [v4.13.154.0] INFO (async) GET mcs-push-server-eu-west-1.prod.hydra.sophos.com:443/.../0089d6b7-83c0-149f-2a0e-188e5237df41
2021-03-15T17:37:06.612Z [ 4624: 1968] [v4.13.154.0] INFO (async) 200 : connection established
2021-03-15T17:37:06.612Z [ 4624: 1968] [v4.13.154.0] INFO (async) 200 : chunk=1 rcvd=6 conntime=510ms

Maybe compare them to the working ones.  Any different?

I have hydra.sophos.com in my Firewall rules, but it says unresolved. I will try to get this fixed.

2021-03-17T10:41:45.004Z [ 2732: 2900] [v4.13.16.0] INFO GET mcs2-cloudstation-eu-west-1.prod.hydra.sophos.com:443/.../e238f0f0-da92-9437-68c7-105ff0476c3f
2021-03-17T10:41:45.094Z [ 2732: 2900] [v4.13.16.0] INFO 200 : sent=0 rcvd=140 elapsed=90ms
2021-03-17T10:41:45.095Z [ 2732: 2900] [v4.13.16.0] INFO Establishing push connection
2021-03-17T10:41:45.096Z [ 2732: 2900] [v4.13.16.0] INFO [push]: [connect] trying server mcs-push-server-eu-west-1.prod.hydra.sophos.com/ps
2021-03-17T10:41:45.096Z [ 2732: 2900] [v4.13.16.0] INFO [push]: [connect] trying direct connection without a proxy
2021-03-17T10:41:45.096Z [ 2732: 2900] [v4.13.16.0] INFO failed to set WinHttp TCP timeout: error=12009
2021-03-17T10:41:45.096Z [ 2732: 2900] [v4.13.16.0] INFO GET mcs-push-server-eu-west-1.prod.hydra.sophos.com:443/ps
2021-03-17T10:41:45.139Z [ 2732: 2900] [v4.13.16.0] INFO 200 OK: sent=0 rcvd=0 elapsed=43ms
2021-03-17T10:41:45.139Z [ 2732: 2900] [v4.13.16.0] INFO [push]: [connect] using server mcs-push-server-eu-west-1.prod.hydra.sophos.com/ps without a proxy (peer address 34.250.42.116)
2021-03-17T10:41:45.142Z [ 2732: 2900] [v4.13.16.0] INFO failed to set WinHttp TCP timeout: error=12009
2021-03-17T10:41:45.142Z [ 2732: 2900] [v4.13.16.0] INFO (async) GET mcs-push-server-eu-west-1.prod.hydra.sophos.com:443/.../e238f0f0-da92-9437-68c7-105ff0476c3f
2021-03-17T10:42:06.233Z [ 2732: 2900] [v4.13.16.0] WARN (async) connection timeout
2021-03-17T10:42:06.233Z [ 2732: 2900] [v4.13.16.0] WARN [push]: error creating async stream: 0
2021-03-17T10:42:06.233Z [ 2732: 2900] [v4.13.16.0] INFO [push]: Dropping connection after error

I can see 34.250.42.116 is allowed through my Firewall

https connections to 34.241.91.8, 52.211.62.246 and 52.51.249.196 are being dropped

I double checked the sophos list with the websites in my FW, all are there, only hydra.sophos.com stays unresolved. I have a rule that allows all Internal Sources HTTPS traffic to Sophos recommended websites. This does not work, there is a timeout when it tries to push.

If I allow all traffic to all sites, then the push is succesful.

Is it an XG firewall?  Any clue as to why it's being dropped?  What rule is it hitting?

It is still an UTM. I fixed it temporarely by adding extra IP adresses. I noticed those adresses were being blocked at the time I was installing InterceptX. By adding more and more (now 9 in total) of these adresses Live Discover started to see my Devices. Next on my list is to determine which of these 9 adresses are actually needed.

Thank you for your confirmation, Please keep us posted and let us know if you have more queries about this. I have marked your response as the answer of this query.