This is an expected behavior as certain unused firewall services will be disabled as a best practice to reduce potential attack surface. Services would only be started if they are actually used. The following image shows that the IPReputation service is stopped in the XG Firewall's Control Center.
The services (ctasd and ctipd specifically, which are used for email filtering only) were not disabled due to a security incident or risk.
On some firewalls, the anti-spam service was started & running even when email filtering was not in use - which consumed unnecessary resources.
The following sections are covered:
Applies to the following Sophos products and versions Sophos Firewall
This behavior was recently corrected and the service is now disabled when it’s not needed. The next MR release (SFOS v18 MR1-1) will fix the erroneous UI alert on the Control Center dashboard and can be ignored in the meantime.
A device reboot will also clear this incorrect UI alert.
This article will be updated when any new information becomes available.
Sign up to the Sophos Support SMS Notification Service to get the latest product release information and critical issues.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. For technical support post a question to the community. Or click here for new feature/product improvements. Alternatively for paid/licensed products open a support ticket.