Sophos Client AV Blocking all connection of workstations

Question

today morning several users report can't login systems and apps, after we discover the allow all traffic option in Sophos firewall tab in client side removed automatically. then we put the traffic allow tick again, then the all blocking process stopped and allow connection as past. 
 i have attached several logs for the reference. please check and assist to sort out this issue. 
 ALUpdate.rar

QC · Accepted Answer

Hello Chamara, 
 both the Router ( 15.11.2017 15:20:45 1BA4 I Routing to Agent: id=060C0DF5, origin=Router$DC-IRDAV.EM, dest=Router$07UNIT-5E:180241.Agent, type=EM-SetConfiguration ) and the Agent ( 15.11.2017 15:20:45 19A8 I Received configuration for SCF ) log confirm that a firewall policy was received from the management server. In the Agent log 15.11.2017 15:20:45 1A48 I SCF state observer received a status: shows that it was RevID=" FactoryDefault " , with the mode non-interactive-block . 
 There was something that looks like an attempt to redeploy Sophos in the early afternoon (around 14:44) which failed as another one (that eventually succeeded) was apparently in progress. And it seems that the endpoint was directed to another management server. Either (if it was already known) it ended up in the wrong group, has been move to a group with the Default policy, or the group had the Default assigned. 
 BTW: You might want to delete the WeTransfer ... 
 Christian