This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unable to install Sophos server endpoint via cache relay

Hi,

We have setup a server with access to the internet and have set this up as a cache relay, we are now trying to roll out Sophos endpoint to other servers via the cache relay as other servers do not have internet connectivity

The installation fails when we run on any server.

Here are the logs below:

Our Cache relay is 10.250.3.5, I can telnet on port 8190 and 8191 so not sure what to try next.. I have also added routes to 10.250.3.5 and even a host file entry, I am also able to resolve the name of the server correctly via NSLOOKUP

Started C:\Users\User1_~1\AppData\Local\Temp\sfl-2685a100\Setup.exe
2020-05-20T15:48:07.4071153Z INFO : Stage 1 command-line options:
2020-05-20T15:48:07.4071153Z INFO : ---
2020-05-20T15:48:07.4071153Z INFO : Quiet mode on: 0
2020-05-20T15:48:07.4071153Z INFO : Automatic Proxy detection disabled: 0
2020-05-20T15:48:07.4071153Z INFO : No feedback mode on: 0
2020-05-20T15:48:07.4071153Z INFO : Dump feedback enabled: 0
2020-05-20T15:48:07.4071153Z INFO : Bypass competitor removal: 0
2020-05-20T15:48:07.4071153Z INFO : Using CRT catalog file path: --
2020-05-20T15:48:07.4071153Z INFO : Only register endpoint with Central: 0
2020-05-20T15:48:07.4071153Z INFO : Log messages between endpoint and Central: 0
2020-05-20T15:48:07.4071153Z INFO : Log command-line passed to executables: 0
2020-05-20T15:48:07.4071153Z INFO : Using custom server that hosts the installer stage2 filename : --
2020-05-20T15:48:07.4071153Z INFO : Using cloud group: --
2020-05-20T15:48:07.4071153Z INFO : Overriding computer name: --
2020-05-20T15:48:07.4071153Z INFO : Overriding computer description: --
2020-05-20T15:48:07.4071153Z INFO : Overriding domain name: --
2020-05-20T15:48:07.4071153Z INFO : Language will be set to: --
2020-05-20T15:48:07.4071153Z INFO : Using message relays: 10.250.3.5:8190
2020-05-20T15:48:07.4071153Z INFO : Proxy address: --
2020-05-20T15:48:07.4071153Z INFO : Proxy user name: --
2020-05-20T15:48:07.4071153Z INFO : Using custom customer token: --
2020-05-20T15:48:07.4071153Z INFO : Using specified products: --
2020-05-20T15:48:07.4071153Z INFO : Using certificates from the MCS app data folder.: 0
2020-05-20T15:48:07.4071153Z INFO : Using custom customer ID.: --
2020-05-20T15:48:07.4071153Z INFO : Using specified user ID.: --
2020-05-20T15:48:07.4071153Z INFO : Using local install source.: --
2020-05-20T15:48:07.4071153Z INFO : ---
2020-05-20T15:48:07.4227707Z INFO : Sending HTTP 'POST' request to: api/download/stage2-details/83dc96e1-258d-4a2d-ba84-f60affd8c112
2020-05-20T15:48:07.4383576Z WARNING : WinHttpGetProxyForUrl returned: 12180
2020-05-20T15:48:07.4383576Z INFO : Attempting to connect using proxy '10.250.3.5:8190' of type 'Message Relay'.
2020-05-20T15:48:07.4383576Z INFO : Set security protocol: 00000800
2020-05-20T15:48:07.4383576Z INFO : Opening connection to dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com
2020-05-20T15:48:07.4383576Z INFO : Request content size: 28
2020-05-20T15:48:17.8758116Z INFO : Response status code: 502
2020-05-20T15:48:17.8758116Z INFO : Response data size: 0
2020-05-20T15:48:17.8758116Z INFO : trySendRequestThroughPotentialProxy returning response with status code: 502
2020-05-20T15:48:17.8758116Z INFO : Failed to connect using proxy '10.250.3.5:8190' with error: Bad response from new connection: status code=502
2020-05-20T15:48:17.8758116Z INFO : Attempting to connect using proxy '' of type 'Empty Proxy'.
2020-05-20T15:48:17.8758116Z INFO : Set security protocol: 00000800
2020-05-20T15:48:17.8758116Z INFO : Opening connection to dzr-api-amzn-eu-west-1-9af7.api-upe.p.hmr.sophos.com
2020-05-20T15:48:17.8758116Z INFO : Request content size: 28
2020-05-20T15:48:28.4438776Z ERROR : WinHttpSendRequest failed with error 12007
2020-05-20T15:48:28.4438776Z INFO : Failed to connect using proxy '' with error: WinHttpSendRequest failed
2020-05-20T15:48:28.4438776Z INFO : Cleaning up extracted files
2020-05-20T15:48:31.6202558Z INFO : FindMainWindow: pid=0
2020-05-20T15:48:31.6514913Z ERROR : Exception: Failed to get stage-2 info: Failed to connect with any proxy

Thanks,

This thread was automatically locked due to age.

0 Shweta over 4 years ago

Hi ObScEANe

SophosSetup.exe is unable to make a connection to Sophos URLs, please check the steps listed in this article and see if it helps.

Shweta

Community Support Engineer | Sophos Technical Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 ObScEANe over 4 years ago in reply to Shweta

Hi,

My cache relay is fine, it can connect out and I have set the netsh setting and it worked fine, its the servers that connect to the cache relay that are having the issue and I have also tried this and it has not worked..

Any other ideas?
Cancel
Vote Up 0 Vote Down

Cancel
0 DianneY over 4 years ago in reply to ObScEANe

Hello ObScEANe

What is the command are you using to run the installation?
Cancel
Vote Up 0 Vote Down

Cancel
0 ObScEANe over 4 years ago in reply to DianneY

I have placed the SophosSetup.exe within c:\temp, and from CMD in this location I run "SophosSetup.exe --messagerelays=10.250.3.5:8190"

After about 10 seconds of it saying downloading it fails and displays the below
Cancel
Vote Up 0 Vote Down

Cancel
0 DianneY over 4 years ago in reply to ObScEANe

Hi ObScEANe

Ok that looks about right. What's the status of the Cache/Relay in Sophos central? You should see this in Global Settings > Manage Update Caches and Message Relays.
Cancel
Vote Up 0 Vote Down

Cancel
0 ObScEANe over 4 years ago in reply to DianneY

Cache relay is active, there are no issues with the cache relay server its servers within our environment trying from the cache relay server
Cancel
Vote Up 0 Vote Down

Cancel
0 DianneY over 4 years ago in reply to ObScEANe

Hello ObScEANe

Are you able to ping the server from the endpoint, and vise versa just to be sure that we can confirm that the server can also talk to the endpoint?
Cancel
Vote Up 0 Vote Down

Cancel
0 MEric over 4 years ago in reply to ObScEANe

Hi,

Based on the error in your logs it looks like the client is getting an HTTP status code return of 502.
502 Bad Gateway
The server, while acting as a gateway or proxy, received an invalid response from the upstream server it accessed in attempting to fulfill the request.

For 500 error codes, something responded back to the client with the 502 error, it could be the server or it might be a firewall in between that could be intercepting or modifying the traffic. I would check to make sure that this connection is unfettered as well as attempt a telnet test to the message relay on port 8190. The result of a successful telnet test should be a quiet connection with no errors.
Cancel
Vote Up 0 Vote Down

Cancel
0 ObScEANe over 4 years ago in reply to DianneY

Yes, we can ping both ways, Nslookup shows the correct server information and can telnet from the endpoint to the cache relay on 8190
Cancel
Vote Up 0 Vote Down

Cancel
0 ObScEANe over 4 years ago in reply to MEric

We have performed wireshark tests amongst other tests, it appears that the endpoint is passing traffic to the cache relay but the cache relay is having issues passing it on or beyond the proxy, really not sure where we go from here, was hoping somebody had seen this issue before and help..
Cancel
Vote Up 0 Vote Down

Cancel