This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Server Offline in Live Discover

Just starting with InterceptX for Server. Installation is complete, my Servers are communicating with the cloud.

When I go to Live Discover I notice that some Servers are Offline, but in my Server overview I can see activity a few minutes ago. How can I get my Servers into Online status?

This thread was automatically locked due to age.

Top Replies

GlennSen over 3 years ago +1

Hi There, Can you confirm if you avail to XDR EAP? Have you already allowed all Sophos domains and ports on your Network? The Live Discover online/offline status is controlled by the push server…

Parents

0 Sophos User930 over 3 years ago

In the mcsclient.log on the computers in the failure state, do you see any errors around this stage:

2021-03-15T17:37:05.871Z [ 4624: 7972] [v4.13.154.0] INFO Establishing push connection
2021-03-15T17:37:05.875Z [ 4624: 7972] [v4.13.154.0] INFO [push]: [connect] trying server mcs-push-server-eu-west-1.prod.hydra.sophos.com/ps
2021-03-15T17:37:05.875Z [ 4624: 7972] [v4.13.154.0] INFO [push]: [connect] trying direct connection without a proxy
2021-03-15T17:37:05.875Z [ 4624: 7972] [v4.13.154.0] INFO GET mcs-push-server-eu-west-1.prod.hydra.sophos.com:443/ps
2021-03-15T17:37:06.096Z [ 4624: 7972] [v4.13.154.0] INFO 200 : sent=0 rcvd=0 elapsed=220ms
2021-03-15T17:37:06.096Z [ 4624: 7972] [v4.13.154.0] INFO [push]: [connect] using server mcs-push-server-eu-west-1.prod.hydra.sophos.com/ps without a proxy (peer address x.x.x.x)
2021-03-15T17:37:06.102Z [ 4624: 7972] [v4.13.154.0] INFO (async) GET mcs-push-server-eu-west-1.prod.hydra.sophos.com:443/.../0089d6b7-83c0-149f-2a0e-188e5237df41
2021-03-15T17:37:06.612Z [ 4624: 1968] [v4.13.154.0] INFO (async) 200 : connection established
2021-03-15T17:37:06.612Z [ 4624: 1968] [v4.13.154.0] INFO (async) 200 : chunk=1 rcvd=6 conntime=510ms

Maybe compare them to the working ones. Any different?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Sophos User930 over 3 years ago

In the mcsclient.log on the computers in the failure state, do you see any errors around this stage:

2021-03-15T17:37:05.871Z [ 4624: 7972] [v4.13.154.0] INFO Establishing push connection
2021-03-15T17:37:05.875Z [ 4624: 7972] [v4.13.154.0] INFO [push]: [connect] trying server mcs-push-server-eu-west-1.prod.hydra.sophos.com/ps
2021-03-15T17:37:05.875Z [ 4624: 7972] [v4.13.154.0] INFO [push]: [connect] trying direct connection without a proxy
2021-03-15T17:37:05.875Z [ 4624: 7972] [v4.13.154.0] INFO GET mcs-push-server-eu-west-1.prod.hydra.sophos.com:443/ps
2021-03-15T17:37:06.096Z [ 4624: 7972] [v4.13.154.0] INFO 200 : sent=0 rcvd=0 elapsed=220ms
2021-03-15T17:37:06.096Z [ 4624: 7972] [v4.13.154.0] INFO [push]: [connect] using server mcs-push-server-eu-west-1.prod.hydra.sophos.com/ps without a proxy (peer address x.x.x.x)
2021-03-15T17:37:06.102Z [ 4624: 7972] [v4.13.154.0] INFO (async) GET mcs-push-server-eu-west-1.prod.hydra.sophos.com:443/.../0089d6b7-83c0-149f-2a0e-188e5237df41
2021-03-15T17:37:06.612Z [ 4624: 1968] [v4.13.154.0] INFO (async) 200 : connection established
2021-03-15T17:37:06.612Z [ 4624: 1968] [v4.13.154.0] INFO (async) 200 : chunk=1 rcvd=6 conntime=510ms

Maybe compare them to the working ones. Any different?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 ErikB over 3 years ago in reply to Sophos User930

I have hydra.sophos.com in my Firewall rules, but it says unresolved. I will try to get this fixed.
Cancel
Vote Up +1 Vote Down

Cancel
0 ErikB over 3 years ago in reply to Sophos User930

2021-03-17T10:41:45.004Z [ 2732: 2900] [v4.13.16.0] INFO GET mcs2-cloudstation-eu-west-1.prod.hydra.sophos.com:443/.../e238f0f0-da92-9437-68c7-105ff0476c3f
2021-03-17T10:41:45.094Z [ 2732: 2900] [v4.13.16.0] INFO 200 : sent=0 rcvd=140 elapsed=90ms
2021-03-17T10:41:45.095Z [ 2732: 2900] [v4.13.16.0] INFO Establishing push connection
2021-03-17T10:41:45.096Z [ 2732: 2900] [v4.13.16.0] INFO [push]: [connect] trying server mcs-push-server-eu-west-1.prod.hydra.sophos.com/ps
2021-03-17T10:41:45.096Z [ 2732: 2900] [v4.13.16.0] INFO [push]: [connect] trying direct connection without a proxy
2021-03-17T10:41:45.096Z [ 2732: 2900] [v4.13.16.0] INFO failed to set WinHttp TCP timeout: error=12009
2021-03-17T10:41:45.096Z [ 2732: 2900] [v4.13.16.0] INFO GET mcs-push-server-eu-west-1.prod.hydra.sophos.com:443/ps
2021-03-17T10:41:45.139Z [ 2732: 2900] [v4.13.16.0] INFO 200 OK: sent=0 rcvd=0 elapsed=43ms
2021-03-17T10:41:45.139Z [ 2732: 2900] [v4.13.16.0] INFO [push]: [connect] using server mcs-push-server-eu-west-1.prod.hydra.sophos.com/ps without a proxy (peer address 34.250.42.116)
2021-03-17T10:41:45.142Z [ 2732: 2900] [v4.13.16.0] INFO failed to set WinHttp TCP timeout: error=12009
2021-03-17T10:41:45.142Z [ 2732: 2900] [v4.13.16.0] INFO (async) GET mcs-push-server-eu-west-1.prod.hydra.sophos.com:443/.../e238f0f0-da92-9437-68c7-105ff0476c3f
2021-03-17T10:42:06.233Z [ 2732: 2900] [v4.13.16.0] WARN (async) connection timeout
2021-03-17T10:42:06.233Z [ 2732: 2900] [v4.13.16.0] WARN [push]: error creating async stream: 0
2021-03-17T10:42:06.233Z [ 2732: 2900] [v4.13.16.0] INFO [push]: Dropping connection after error

I can see 34.250.42.116 is allowed through my Firewall

https connections to 34.241.91.8, 52.211.62.246 and 52.51.249.196 are being dropped
Cancel
Vote Up 0 Vote Down

Cancel
0 ErikB over 3 years ago in reply to Sophos User930

I double checked the sophos list with the websites in my FW, all are there, only hydra.sophos.com stays unresolved. I have a rule that allows all Internal Sources HTTPS traffic to Sophos recommended websites. This does not work, there is a timeout when it tries to push.

If I allow all traffic to all sites, then the push is succesful.
Cancel
Vote Up 0 Vote Down

Cancel
0 Sophos User930 over 3 years ago in reply to ErikB

Is it an XG firewall? Any clue as to why it's being dropped? What rule is it hitting?
Cancel
Vote Up 0 Vote Down

Cancel
+1 ErikB over 3 years ago in reply to Sophos User930

It is still an UTM. I fixed it temporarely by adding extra IP adresses. I noticed those adresses were being blocked at the time I was installing InterceptX. By adding more and more (now 9 in total) of these adresses Live Discover started to see my Devices. Next on my list is to determine which of these 9 adresses are actually needed.
Cancel
Vote Up +1 Vote Down

Cancel
0 GlennSen over 3 years ago in reply to ErikB

Thank you for your confirmation, Please keep us posted and let us know if you have more queries about this. I have marked your response as the answer of this query.

Glenn ArchieSeñas (GlennSen)

Global Community Support Engineer

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel