NDR - Sophos Central shows: Status warning - "Unhealthy: ens160: unhealthy span"

Hello Community,

we experience the problem in the subject.

Appliance NDR in vmware environment seems working well because it comunicates with Sophos Central.

In Sophos Central under Detections filtering with category Network, we can see messages sent by the appliance but its state in red with error "Unhealthy: ens160: unhealthy span"

Searching in sophos forums I found that this error is related to SPAN1 port but I don' t understand why.

Does anyone have any suggestions for me?

Thanks in advance.

Top Replies

Gianluca Maistri 1 month ago in reply to Gianluca Maistri +1 suggested

It was a problem related to firewall filter. I set exclusion as indicated in the link below and alert went away. Requisiti dell’appliance - Sophos Central Admin

Parents

0 LuCar Toni 2 months ago

Is this NDR Appliance installed on Hyper-V and you are using VLANs on your SPAN Port?
Because unhealthy Span Port means, there are not enough "Valid looking packets" on the SPAN Port, meaning the deployment is not correct.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Gianluca Maistri 2 months ago in reply to LuCar Toni

Thanks Lucar for your rapid response.

NDR Appliance is not on Hyper-V, it's in a VMWARE environment.

I 'm going to obtain further information regarding deployment of the appliance and configuration of mirroring port (on the physical switch) and then I'll come back to you.

Thanks again.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni 2 months ago in reply to Gianluca Maistri

Try to follow this deployment Guide: Sophos Appliance Support Guide v1

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Gianluca Maistri 2 months ago in reply to LuCar Toni

Thanks for the document. It seemed to be a problem related to switch misconfiguration. Customer reconfigured port mirroring on it.

Now we get a different alert in Sophos Central regarding NDR Integrated Appliances: Unhalthy: Post "nta-proxy.cloudstation.eu-central1.prod.hydra.sophos.com/.../reporting......presigned url" :Dial TCP lookup nta-proxy.cloudstation.eu-central1.prod.hydra.sophos.com on 100.64.26.10:53 server misbehaving.

I searched inormation about it on sophos sites without luck.

PS: On Live Discover using "NDR query" all seems to work infact we get information about network traffic monitored by the NDR Appliance.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Gianluca Maistri 1 month ago in reply to Gianluca Maistri

It was a problem related to firewall filter. I set exclusion as indicated in the link below and alert went away.

Requisiti dell’appliance - Sophos Central Admin
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel

Reply

0 Gianluca Maistri 1 month ago in reply to Gianluca Maistri

It was a problem related to firewall filter. I set exclusion as indicated in the link below and alert went away.

Requisiti dell’appliance - Sophos Central Admin
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel

Children

No Data