NDR - Sophos Central shows: Status warning - "Unhealthy: ens160: unhealthy span"

Is this NDR Appliance installed on Hyper-V and you are using VLANs on your SPAN Port? 
Because unhealthy Span Port means, there are not enough "Valid looking packets" on the SPAN Port, meaning the deployment is not correct. 

Thanks Lucar for your rapid response.

NDR Appliance is not on Hyper-V, it's in a VMWARE environment.

I 'm going to obtain further information regarding deployment of the appliance  and configuration of mirroring port (on the physical switch) and then I'll come back to you.

Thanks again.

Thanks Lucar for your rapid response.

NDR Appliance is not on Hyper-V, it's in a VMWARE environment.

I 'm going to obtain further information regarding deployment of the appliance  and configuration of mirroring port (on the physical switch) and then I'll come back to you.

Thanks again.

Try to follow this deployment Guide:  Sophos Appliance Support Guide v1  

Thanks for the document. It seemed to be a problem related to switch misconfiguration. Customer reconfigured port mirroring on it.

Now we get a different alert in Sophos Central regarding NDR Integrated Appliances: Unhalthy: Post "nta-proxy.cloudstation.eu-central1.prod.hydra.sophos.com/.../reporting......presigned url" :Dial TCP lookup nta-proxy.cloudstation.eu-central1.prod.hydra.sophos.com on 100.64.26.10:53 server misbehaving.

I searched inormation about it on sophos sites without luck.

PS: On Live Discover using "NDR query" all seems to work infact we get information about network traffic monitored by the NDR Appliance.

It was a problem related to firewall filter. I set exclusion as indicated in the link below and alert went away.

Requisiti dell’appliance - Sophos Central Admin