Thread Info
  • State Not Answered
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 24 replies
  • Subscribers 16 subscribers
  • Views 2841 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Heartbeat Stops Reporting Knocking PC Off Network

SophosNewby

Good morning all, I am beginning to have a serious issue with our PC's since moving over to Sophos Intercept X Advanced. I am beginning to have PC's stop sending their Heartbeat, Sophos Central shows the PC as no longer sending a heartbeat and I believe what happens is the system goes into a protected mode, preventing the PC from having any network access, actually preventing its IP so my network icon immediately changes from connected to no connection. Most of the time the PC's are bouncing back and resume sending the heartbeat without any intervention on my part.

However some are not bouncing back and left in this disconnected state until, I manually assign an IP address to get the heartbeat back then I can simply reset the network card back to DHCP. This is beginning to be a serious issue, as yesterday this happened to 3 PC's and today I just back from our other plant because of the same issue on another PC.

Any users experienced something similar? Intercept X is managed through Sophos Central as well we do have a Sophos XG firewall that ties everything together. I have reached out to Sophos support but in the meantime if anyone has some suggestions to possible look at, please let me know, I'm at a loss as to why this is happening, if it's a bug, I'm not sure.

Thank you



This thread was automatically locked due to age.
Parents
  • 0

    Oh I should also add before someone asks, when Sophos Central reports the device as no longer sending a heartbeat, I do acknowledge the event to allow the PC status to go back to green because my firewall rule does have the Security heart enabled on the PC must at least have an amber status or greater to maintain its network connection.

  • 0 in reply to SophosNewby

    Heartbeat can periodically not be sent when services are starting up/recycling or any other network interruption. Also, at reboot, the services don't start in a set order so the network elements could start up before Health does and therefore there is no Heartbeat to send. 

    In general, the endpoint itself isn't stopping the traffic - it is the firewall that is dropping the traffic. Is this traffic bound for an external resource or an internal one?

    RichardP

    Program Manager, Support Readiness | CISSP | Sophos Technical Support
    Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.

  • 0 in reply to RichardP

    Thank you for the reply, all traffic is blocked, the PC no longer has a network connection period, it can't be pinged, restarting the device does nothing, it stays in a blocked state completely. Until I manually assign another IP address does the PC become pingable again. Once it notices the heartbeat, all traffic is resumed. These PC's have been on this firewall now for 4 years, with another anti-virus product, zero issues. Since moving the PC to Intercept X, allowing the PC to basically self quarantine itself in the policies and changing the heartbeat requirements on the main firewall rule has this become an issue so it is definitely since making these changes. Had another PC today that its heartbeat stopped sending on Friday at 5.30pm, I had to go over to the plant with the PC today, manually assign its IP, allow the heartbeat the resume, and put back on DHCP to get it communicating on the network again, it does not bounce back  on it's own.

  • 0 in reply to SophosNewby

    Okay, that isn't Heartbeat. Do you have Device Isolation turned on in your Endpoint policy?

    RichardP

    Program Manager, Support Readiness | CISSP | Sophos Technical Support
    Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.

  • 0 in reply to RichardP

    unless your DHCP server is beyond the firewall from the machine. What is the network topography?

    RichardP

    Program Manager, Support Readiness | CISSP | Sophos Technical Support
    Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.

Reply Children
Unfiltered HTML