We have an issue where PCs are losing connection to Sophos Central and it shows them as not checking in any longer. Sophos is still running on the endpoints and updating. Sophos support is saying there is DNS issues that are causing machines to not be able to connect.
We have it happening as follows:
Both Servers and PCs
It is happening in multiple domains
We have multiple sub estates
We have multiple Sophos tenants
Both servers in the cloud and on prem
PCs both on prem and remote
Anyone else seeing this?
Thank you for reaching out to the Sophos Community Forum.
Could you share output from the MCS logs located at "C:\ProgramData\Sophos\Management Communications System\Endpoint\Logs\"?
What may also help is to try browsing a few of the Sophos update websites via a web browser. Typically when going to the sites mentioned on the following page, you will see a "Connection Successful" message.- Domains and ports to allow- dci.sophosupd.com- d1.sophosupd.com
what is your firewall solution on that company site?
We use Fortigates as an enterprise solution, but this is also happening for people who are working remotely not behind our firewalls.
ok, remote workers should not be affected as long as you do not VPN all their traffic behind your internal firewall.
There is to know that Sophos uses a huge list of FQDN that are contacted frquently and that need to be resolved.
Qoosh gave you all the information that you need to check You need to disable Tamper protection to get the local logs from MCS..
search for logs not getting code 200
but 504 sometimes may not indicate a real error. that is a lost known issue
Also check the windows event log / Application.