This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall lost connection to Sophos Central: all HA Aux nodes reporting this alert

LHerzog over 2 years ago

Today our Central-managed XG and XGS Clusters are reporting this issue.

18.0 MR6, 18.5 MR2 and MR3

Latest wave of alerts:

4:19-4:25 PM CEST

The nodes reported are all the Auxiliary HA nodes.

This applies to different locations accross germany, different ISP and different WAN link technologies.

Can you please provide information about this issue?

If it was not something scripted by Sophos, it should be an issue in your Central cloud...

This thread was automatically locked due to age.

Top Replies

Vivek Jagad over 2 years ago +1

Hi LHerzog Thank you for your query, this may appear due to connection interruption between central and firewall, possibly due to packet loss or unstable gateway, etc. You may check centralmanagement.log…

Parents

0 Vivek Jagad over 2 years ago

Hi LHerzog

Thank you for your query, this may appear due to connection interruption between central and firewall, possibly due to packet loss or unstable gateway, etc.

You may check centralmanagement.log from your firewall to validate more on this. Please check out the following document for Log file details.
https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/LogFileDetails/index.html

You may also refer to the Sophos Central Status check for any such outage in the central services:
https://centralstatus.sophos.com/#!/

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel
0 LHerzog over 2 years ago in reply to Vivek Jagad

Hi,

this would be if there were nation-wide WAN issues in Germany. I've not heard of such.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 2 years ago in reply to LHerzog

Interesting, did you check the status on the central: https://centralstatus.sophos.com/#!/
For that particular day when that happened ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog over 2 years ago in reply to Vivek Jagad

yes, there was nothing listed on the status page

why should it only happen to the aux nodes of a cluster? that does not make sense to me
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LHerzog over 2 years ago in reply to Vivek Jagad

yes, there was nothing listed on the status page

why should it only happen to the aux nodes of a cluster? that does not make sense to me
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Vivek Jagad over 2 years ago in reply to LHerzog

Hmm, interesting, are the aux nodes configured as [HA A-P]passive or [HA A-A] active ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog over 2 years ago in reply to Vivek Jagad

it's active passive.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 2 years ago in reply to LHerzog

Under one the passive appliance, can you check the /log/centralmanagement.log for that date, if the logs are not rotated yet ?

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog over 2 years ago in reply to Vivek Jagad

I checked them today and both rotated May 13th out on our appliances.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 2 years ago in reply to LHerzog

Dang! I guess we will have to wait if the issue occurs again...

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel