This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG and security heartbeat

hello, this morning there was a problem with the firewall in connection with security heartbeat. The clients at one location were no longer connected to the internet and could not reach the other locations. We assume that this incident is related to security heartbeat. This incident occurred at around 7am. However, after a ping was sent from the "isolated" computer to a server at the other site, the connection was restored. What could be the reason that the PCs and servers at that location no longer had access to the Internet and the other networks? Around 9 o'clock everything was working normally again

Regards, Leon

This thread was automatically locked due to age.

0 GlennSen over 2 years ago

Hi admin_idl,

Can you confirm if those PCs and the server have Sophos endpoint install to them as well? If so? Are you observing some alerts on endpoint UI?

Glenn ArchieSeñas (GlennSen)

Global Community Support Engineer

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 admin_idl over 2 years ago in reply to GlennSen

Hi,

yes, the software is installed on all devices. Unfortunately, no alerts could be detected at this time. I have already opened a case about this.

Best Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 Fred_B over 2 years ago

Have you set hot fixes to be applied automatically? Have you enabled email notifications?

During night times I have received multiple disconnect notifications in the past that were linked to hot fixes being installed. The connections (IPSEC, RED) sofar always reconnected automatically.
Cancel
Vote Up 0 Vote Down

Cancel
0 admin_idl over 2 years ago in reply to Fred_B

New Problem today:

servers with endpoint protection and securty heartbeat cannot ping the servers. Servers without endpoint protection can still be pinged.

Any ideas?
Cancel
Vote Up 0 Vote Down

Cancel
0 GlennSen over 2 years ago in reply to admin_idl

Hiadmin_idl,

Thank you for sharing your findings. Can you share with us the case ID that you've raised for this. Also, have you collected the logs on one of the problematic servers? If Not? Please collect the logs and share it as well on the case.

Glenn ArchieSeñas (GlennSen)

Global Community Support Engineer

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 admin_idl over 2 years ago in reply to GlennSen

Tomorrow i will call our customer and i will ask him to send the logs from different computers.
Cancel
Vote Up 0 Vote Down

Cancel