Thread Info
  • State Not Answered
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 24 replies
  • Subscribers 16 subscribers
  • Views 3279 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Heartbeat Stops Reporting Knocking PC Off Network

SophosNewby

Good morning all, I am beginning to have a serious issue with our PC's since moving over to Sophos Intercept X Advanced. I am beginning to have PC's stop sending their Heartbeat, Sophos Central shows the PC as no longer sending a heartbeat and I believe what happens is the system goes into a protected mode, preventing the PC from having any network access, actually preventing its IP so my network icon immediately changes from connected to no connection. Most of the time the PC's are bouncing back and resume sending the heartbeat without any intervention on my part.

However some are not bouncing back and left in this disconnected state until, I manually assign an IP address to get the heartbeat back then I can simply reset the network card back to DHCP. This is beginning to be a serious issue, as yesterday this happened to 3 PC's and today I just back from our other plant because of the same issue on another PC.

Any users experienced something similar? Intercept X is managed through Sophos Central as well we do have a Sophos XG firewall that ties everything together. I have reached out to Sophos support but in the meantime if anyone has some suggestions to possible look at, please let me know, I'm at a loss as to why this is happening, if it's a bug, I'm not sure.

Thank you



This thread was automatically locked due to age.
  • 0 in reply to FormerMember

    Thank you, yes I have supplied multiple SDU's and have had very little help, think I created the case 3 or so weeks ago. You gave me more help or t least what to look into.

  • FormerMember
    0 FormerMember in reply to SophosNewby

    I would suggest that you get an SDU from the affected machines and a CTR from the SFOS and open a support case.

  • 0 in reply to SophosNewby

    Ok so in the end disabling Device Isolation did not solve the issue. I still have PC's reporting their heartbeat is lost and they are blocked form the network. This is getting to be a real pain in the butt and sorry I moved the company over to this product.

  • 0 in reply to FormerMember

    I just had a thought, do you think the issue is related to Synchronized User ID Authentication? Reason I ask is in my logs under Authentication I have dozens and dozens of entries, example below.

    2021-06-21 13:16:26 Authentication messageid="17702" log_type="Event" log_component="Firewall Authentication" log_subtype="Authentication" status="Failed" user="USERNAME" user_group="" client_used="Heartbeat" auth_mechanism="Local" reason="wrong credentials" src_ip="X.X.X.X" message="User USERNAME failed to login to Firewall through Local authentication mechanism from X.X.X.X because of wrong credentials" name="" src_mac=""

    There are no credentials with my users, and synchronized user ID authentication is enabled by default. 

    This is a statement directly on how this system works.

    "If the client Heartbeat is lost or missing, the heartbeat daemon will logout the user from the firewall as a Synchronized ID user, however other client authentication mechanisms may still apply."

  • 0

    So it has been approx. 4 days with Device Isolation disabled and although I am getting the notifications regarding heartbeats not being reported, none of the devices have been prevented access to the network. Obviously there is an issue when Device Isolation is enabled and the device isolates itself, it never recovers from that state on it's own.

  • 0 in reply to LuCar Toni

    I am still on the latest 17 version, I have been hesitant to move up with all my remote staff at the moment and was afraid of something screwing up during the migration to V18. Thank you.

  • 0 in reply to SophosNewby
    SophosNewby said:
    I have turned off Device Isolation to monitor over the next few days, I assumed it was necessary to have this enabled, in case of a PC possibly being compromised and then preventing any lateral movement through the network.

    I suggest you leave this enabled.This is a big security plus but of course this isolation knocks you out in such cases where you have trouble with endpoints getting isolated for no visible reason.

  • 0

    Do you already have V18.0 MR5 installed? There is a switch for Heartbeat switch. https://community.sophos.com/sophos-xg-firewall/f/discussions/127593/e-mail-notification-for-missing-heartbeat/468290#468290

    Try to set the same switch to a higher sec threshold and check. 

    __________________________________________________________________________________________________________________

  • 0 in reply to FormerMember

    Everything on site is LOCAL, the XG being part of the local LAN network along with the DHCP server. XG is our gateway/firewall device, if it were removed the devices would simply not have a way out to the internet, that is it. Should this occur again with device isolation off I'll be sure to check the registry key status.

  • FormerMember
    0 FormerMember in reply to SophosNewby

    Isolation only goes into effect when the Health on the machine is RED. So, once you complete the action that turns it to GREEN, the isolation will be removed on that machine. You can confirm in the registry: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\Health\Status
    The admin, health, service, and threat values are what you care about. 1 is good. 3 is red. So, you can check what the machine thinks it is.

    Since you have two layers that can be affecting network traffic you might be encountering a collision. So, endpoint turns RED, it isolates and reports to the SFOS that it has RED health. SFOS also blocks. If the SFOS is safeguarding the comms to the DHCP server too - this could be a problem. 

    Do you have local DHCP servers in each segment? Or are they all beyond the SFOS from the perspective of the clients? Like you have the DHCP server in segment A and all machines have to route through the SFOS to get there?

Unfiltered HTML