Sophos UTM: Decommissioning of obsolete URL categorization services CFFS.Click here for important info.

Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 21 replies
  • Subscribers 16 subscribers
  • Views 6049 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Intercept X (Endpoint), Sophos XG and iBoss Web Filtering

Tom Yoxall

* Posting here as it touches multiple Sophos products *

We currently have a client that are experiencing significant issues since early last week whereby users of the VPN are being intermittently disconnected and a 'cypher' error detailed within the Sophos Connect client log.

For clarity, they have Sophos Intercept X deployed on all endpoints, and use Sophos Connect to access the corporate network via VPN. The VPN has a split tunnel configuration, with all traffic not destined for corporate internal IP addresses 'sent out' via their local internet breakout, with the traffic protected by iBoss Web Filtering.

Within the local network there have been no changes, and up until this point both Sophos and iBoss have been unable to identify root cause. From initial testing, disabling the iBoss Service appears to 'resolve' the issue. This has been fed back to iBoss, and in turn they said that 'there is an outstanding issue with iBoss and Sophos AV that we are waiting on Sophos to resolve'. Now I don't know how true this is, but is anyone else using this, or a similar, configuration and experiencing similar issues?



This thread was automatically locked due to age.
Parents
  • 0

    Tom,

    We are experiencing similar issues, but we use the FortiClient VPN client.  It seems to have started mid-week last week.  Other things have also been affected, though, including:


    Getting "Failed - Network error" when attempting to download large files from SharePoint Online/OneDrive (also accompanied by "Windows Defender SmartScreen is downloading from OneDrive" notification in Windows.

    Getting errors when trying to open synced files in a user's OneDrive.  One of the errors we've seen is "The cloud operation was not completed before the time-out period expired."

    Getting a "Security Certificate was revoked" for outlook.office365.com message when opening Outlook

    All these issues seem to be temporarily resolved by stopping the IBSA service, but only occur if Sophos is installed and updated.  The versions we have observed are:

    IBSA Version: 5.3.120
    Sophos Core Agent: 2022.2.1.9
    Sophos Intercept X: 2022.1.1.11
    Sophos Endpoint Protection: 10.8.11.4
    Sophos Device Encryption: 2022.1.0.58
    Sophos XDR: 2022.2.1.9

  • 0 in reply to Ian McDougal

    Thank you Ian, this is very interesting. Have Sophos and/or iBoss been able to identify any root cause or provide guidance for further investigation?

    I am awaiting contact from our Sophos Technical Account Manager to clarify the (unverified) claim from iBoss that there is a ‘known issue’ between the two software. 

  • 0 in reply to Tom Yoxall

    Not yet.  I just now put in the ticket, because we've only just narrowed the issue down to Sophos (a machine running ONLY iBoss functions correctly).  I did run across this similar known issue that made me suspect Sophos in the first place, however:  support.sophos.com/.../KB-000044388

  • 0 in reply to Ian McDougal

    That’s an interesting find, thanks for sharing. If you wouldn’t mind could you please update the thread with any breakthroughs from Sophos support and I’ll do likewise. 

  • 0 in reply to Tom Yoxall

    For sure!  We just got this from our ticket with iBoss:

    "Thank you for contacting iboss support. At this time our solution is to place the ibsa (iboss Windows connector service name) onto the Sophos global exclusion list. Additionally we  recommend bypassing your iboss cloud gateway public IP addresses in Sophos as well. The devices will most likely need to be restarted for them to pull the latest update(s) from Sophos. Please let us know if you have any questions or concerns."

  • 0 in reply to Ian McDougal

    So far, it doesn't seem like iBoss's recommendations have fixed it for us.

  • 0 in reply to Ian McDougal

    The IP addresses you will need to add will be different for each iBoss deployment. You can find the IP addresses for the iBoss cloud nodes in your environment by reaching out to iBoss. 

    To add exclusions to Sophos for these IPs you'll need to add these under "Global Exclusions > Website (Windows/Mac)". You can also add exclusions in a Threat Protection Policy.

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to Qoosh

    We have added all the cloud node IP addresses listed in our iBoss cloud account under Node Collection Management, but that doesn't seem to have made a difference.

Reply Children
  • 0 in reply to Ian McDougal

    Ian, I've had confirmation from our Technical Account Manager that there is a known issue between iBoss and Sophos. Sophos' development team are currently working on a resolution, but there are apparently two workarounds available. One has been shared higher in this chain, the other I am waiting on details for. As soon as I have these I'll share them with you.

  • 0 in reply to Tom Yoxall

    Yes, they escalated our case to the development team.  The only things I've found that have solved the issues so far, though, are uninstalling Sophos (disabling services doesn't seem to do anything), or stopping the IBSA service.  I've temporarily deployed a script to all our machines disabling the IBSA service and scheduling a task to set it back to Automatic in two weeks while we wait for a resolution from Sophos.

  • 0 in reply to Ian McDougal

    Hi Ian,

    Out of interest, are you still experiencing the issue? If so, does disabling Network Threat Protection within Sophos ‘resolve’ the issue? We’ve been doing some testing and this doesn’t temporarily resolve it, so wondering if there is a further Sophos issue that feeds into their wider iBoss compatibility issue. 

  • 0 in reply to Tom Yoxall

    Tom,

    Yes, we are still experiencing the issue, and no, disabling network threat protection doesn't appear to resolve the issue.  We have had to temporarily disable the iBoss service on all our machines, which is obviously not ideal.  In my testing, even if I disabled all Sophos services via the endpoint client on a test machine, the issue persisted.  The only thing I could do on the Sophos end of things that would temporarily resolve the issue was uninstall it from the test machine.

    Thanks,

    Ian

  • 0 in reply to Ian McDougal

    Actually, just discovered something that makes me feel a little silly.  If you turn off the service via the endpoint agent (after turning off tamper protection), it doesn't do anything; HOWEVER, if you then go and stop the Sophos Network Protection Service via services.mmc (or CLI), that DOES temporarily resolve the issue.  Not sure why I never thought to test that way.

Unfiltered HTML