SSP.exe creating lots of traffic

Hi Craig,

Sorry I thought you had said that these weren't actually Amazon addresses previously. So are you confirming that the sophosxl.net service is a load balanced system hosted on Amazon AWS servers?

Is there a particular range or list of IP addresses that Sophos use for this? We have found that some of them are blocked by our web filtering software as it thinks they are a "peer-to-peer" connection.

Thanks

Martin

I am slowly getting angry.. another two days without any helpful update on this bug.

I this the way Sophos cares for custumers? Especially in this case where the bug ist caused by a sophos antivirus product update

in combination with an other sophos product (UTM) . Our companys suffers from an absolutely wrecked proxy, an there is literally no

useful help... seriusly WTF? 

Hi, I PM'd you last week - I haven't had a reply.

How is the state of investigation? Can you confirm that this is a Proxy bug?

Do you have found  a solution for your environment? We are in the similar situation (the proxy server with authentication) and going to  disable ssp.exe via GPO

The only real solution would be a hotfix by Sophps for this  bug. But Sophos support is quite horrible as it seems they dont really care. We have been told to disable SSP or to rollback to an older Sophos release ^^.  What helped a litte was to redirect the traffic to the WAF by using a WPAD Proxy config. Seems to bee less cpu sonsuming if the WAF recieves the packages, but still not a suitabble solution in any way.

What I don't understand is, why isn't Sophos at least using the systems proxy settings?
Sophos should implement the whole thing into the enterprise console and make it downloadable like the CIDs.
Or better the message router forwards it to the server and the server asks for the information via proxy and send the reply back to the client. 
Requesting direct internet Access for something like this just plain stupid and I don't think that is suitable for ANY business customers.
Blocking ssp.exe via GPO is another thing. Manually manipulating the services of a security suite?
THIS IS SOMETHING ONE SHOULD MANAGE THROUGH A GUI AKA (SEC).

Hi,

I too fail to understand why any company selling to business customers would expect them to punch holes in their perimeter security,or place major additional load on firewalls/UTMs by using dynamic objects just to make their products work. I really hope Sophos does not join the likes of Adobe in this respect. By all means move services to the cloud, but make sure you support secure access to them. Rant over!

I'd now like to update the community on the latest from my support case on this issue:

Hello Paul,

This case has been escalated to myself for further investigation.

This is a known issue currently with development and will be fixed in an update later in the year (after Sept).   Sophos suggest the following to reduce/stop the traffic hitting the firewall.
 
  1. Open up the firewall to allow connections to 4.sophosxl.net
  2. Add a local DNS record to deny access to 4.sophosxl.net and ssp.feedback.sophos.com
  3. Add a local host entry for 4.sophosxl.net and ssp.feedback.sophos.com to point to 127.0.0.1    (this would need to be on every endpoint)

As long as the SXL4 request receives a valid response (a deny or block will count as a valid response) it will stop sending the request every 30 seconds i would recommend as a short term fix that you look at setting a DNS record to allow these through

I then asked if the fix would make the SSP.exe traffic use the locally configured NTLM proxy and got the following reply:

 I am afraid I am not sure how this fix is going to be implemented as of yet however I believe they are going to force the policy to apply whether the sxl lookup goes through or not. Once its succeeds on this lookup it should  continue using NTLM its just the initial connection which appears to be the issue.

Just a shame that we cannot make use of the new security features of Sophos Endpoint and will rely on the old IDE files for now.

The Endpoint "Web Protection/Web Control" feature has always adhered to the client proxy settings supporting NTLM along the way, so they can do it. Hopefully after the fix, the new SSP features will too.

Whats the state of investigation? Are we going to get some kind of  bugfix in near future? Or did sophos decide to ignore this case ?

We have hundreds of servers on our network so rather than modify hundreds of host files, we added these two zones/addresses to our internal DNS. Now these addresses get blackholed to the 127.0.0.X address range and our firewall drops went from >5000/minute down to ~15/minute. This is a real problem that Sophos needs to address ASAP. Our firewall was being stressed by these excessive drops not to mention the disk space these firewall logs were taking up!

We do not allow our servers access to the Internet not even via our proxy so this SSP issue needs to be resolved. We have tried turning off SSP but it appears to restart itself.