Sophos endpoint blocking internet traffic via ssl vpn, with gateway enabled.

Hello Martorelli Advogados 

Can you please see if stopping any of the Sophos Endpoint Services, for example, the Sophos Web Intelligence service to see if any of these are causing the issue? You did say that you have turned off all of the policies and the issue persists. Please note that Tamper Protection would need to be disabled as well prior to stopping services.

Let us know what may be the offending service. Thanks!

Hello Dianney.

First of all thank you very much for your help. I stopped all services from the sophos endpoint, and disabled the adductor protection as well, and I was unsuccessful.

Hello Martorelli Advogados 

If you disable all options from that screen, you are still unable to connect to the internet?

What about turning off the Sophos services from Services.msc?

Hello DianneY.

  That's right, disabling all the options on this screen, still can't connect to the Internet. Disable all services from the service at: services.msc, 
and continue without surfing the internet.

Hello Martorelli Advogados 

The Sophos Endpoint Defense Service is still running. 

Perhaps do the steps in this KB (while in Safe Mode) to and see if you're able to stop all of the services? Once all of the services has been turned off, see if you can browse?

When you turned off all of the Features in the UI it effectively has turned off Sophos Endpoint. 

Ultimately if you're still unable to browse the internet with all services turned off, maybe you can try uninstalling Sophos Endpoint and see if the issue is still there?

If uninstalling seems to keep the issue from occurring or if one of the services (appear to cause the issue), further investigation is needed at that point, please raise a support case and DM me your ticket number so we can follow the progress on the ticket.

Hello Martorelli Advogados 

The Sophos Endpoint Defense Service is still running. 

Perhaps do the steps in this KB (while in Safe Mode) to and see if you're able to stop all of the services? Once all of the services has been turned off, see if you can browse?

When you turned off all of the Features in the UI it effectively has turned off Sophos Endpoint. 

Ultimately if you're still unable to browse the internet with all services turned off, maybe you can try uninstalling Sophos Endpoint and see if the issue is still there?

If uninstalling seems to keep the issue from occurring or if one of the services (appear to cause the issue), further investigation is needed at that point, please raise a support case and DM me your ticket number so we can follow the progress on the ticket.

Hi Dianney.

Dear. 
 I decided to do the installation from scratch, disable the tamper protection on the control panel, uninstalled the sophos endpoint, and excluded all the 
sophos folders, leaving only the ssl vpn folder, I searched the entire computer and had nothing else on the endpoint, . I connected to the VPN and it worked 
perfectly the way I wanted without any problem, I was able to browse. I restarted the computer, installed the sophos endpoint, restarted the computer again,
 when it came back, a warning appeared in its status and in services.msc, saying that some service was not working, I connected to the vpn and working the way 
I wanted it it is with a public ip of the work, I verified that the service: SOPHOS NETWORK THREAT PROTECTION, was disabled, as soon as I enabled it, the internet 
stopped working by vpn ... In other words, the service that blocks navigation is precisely the: SOPHOS NETWORK TREATH PROTECTION, but I cannot leave this security 
breach, how do I enable this service and be able to use it with the other public IP? can you help me with this? Thank you.

Hi Martorelli Advogados 

Sure, we'll help on this.

Would you please check the user temp folder (%temp%) and confirm if you are able to see the Network Threat Protection installation logs? If not, please check the folder C:\Windows\temp.

We need to check that installation logs of the NTP to know the exact error because of which it is failing.

Hello Jasmine.
Thanks in advance for your help.
My biggest problem is that when the ntp is activated my internet browsing stops, but I'm using the office ip as a gateway, and I'm at home, if I use a ssl vpn without the 
office gateway it works, but I need to use the public ip office and not my home, and it only works if I disable ntp.
I found the file: Sophos Network Threat Protection Install Log 20200530 111006.txt How do I send it?

Hi Martorelli Advogados 

You can search for the error message under the MSI logs and then paste it over here or you can either PM me or Jasmin the log file to check the error. Also, I would suggest you have a look at this link which refers to different scenarios of "Service not starting" for Sophos Endpoint. You can specifically refer to Network threat protection service not starting as mentioned in the article and see if it helps.

Hello Shweta.
My problem is not the service that does not start, this resolved very quickly, my problem is my internet which is blocked using another public ip by ssl vpn, 
and it only works by disabling this service. Enabling and disabling is easy, I need to know how to solve the internet blocking problem.

Hello Martorelli Advogados 

Can you please see if this is applicable to you since you also mentioned that you have SSL VPN:

SSL VPN remote client users are not able to connect due to 3rd party Root CA Sectigo expired

We have two ssl vpn connections:

The 1st ssl vpn to connect the folders on the server, and the public ip is the employee's home, it works on any computer with any anti-virus, nothing is blocked 
everything works perfectly.











 The 2nd ssl vpn is for the employee to connect to the folders on the server and use the public ip of the office and not the ip of his home, and this one after 
connecting, the internet is blocked, on any computer with any antivirus other than the sophos endpoint works. Already on a computer with sophos endpoint the internet 
is blocked, and it only works if I stop the service: SOPHOS NETWORK THREAT PROTECTION, however I need to find out how to get around this problem, I cannot leave this 
service disabled. I can enable this service easily, the problem is that if I enable the internet it doesn't work.

The internet is blocked only by the anti virus sophos endpoint, specifically the service: SOPHOS NETWORK THREAT PROTECTION, This problem does not occur with 
any other anti virus.

Hello Martorelli Advogados 

What is the status of this machine in Sophos Central? Does this machine have a Red status? I ask because the machine may be in "Red" health and Allow computers to isolate themselves on red health is enabled in your Threat Protection policy too. 

Status perfect.

Hi Martorelli Advogados 

Would you please provide the Sntpservice.log file from the path "C:\ProgramData\Sophos\Sophos Network Threat Protection\Logs"?

So, we can check if anything is getting logged which is blocking the internet.