Sophos XGS 2100 cluster reboots itself

Hello, in the last weeks our XGS2100 Firewall cluster rebooted itself a few times - and there's no real pattern.

Without warning I receive this email:

Dear Administrator,

You are receiving this auto-generated message from Sophos Notification System to inform Change in HA Status.

Mode: Active-Passive
Hypervisor assigned MAC addresses: Disabled
Preferred Primary: S3RI4LNUMB3R1 (Node1)
Cluster ID: 0
Dedicated Port: Port8
Monitoring Ports:
Time: 20:02:50 , Feb 12, 2024

Serial Number (Node Name)

Model Number

Firmware Version

Current State

Administration IP

S3RI4LNUMB3R_2 (Node2)

XGS2100

SFOS 19.5.3 MR-3-Build652

Standalone

PortMGMT (10.0.1.1)

S3RI4LNUMB3R_1 (Node1)

XGS2100

SFOS 19.5.3 MR-3-Build652

Fault

PortMGMT (10.0.1.5)

And then, over the course of 8 minutes, I get these mails (extracts):

Time: 20:03

Sophos Central event details for 1234567 - My Company

What happened: One of the HA nodes isn't running or is impaired. The high availability is not impaired.

Where did it happen: S3RI4LNUMB3R_2

User assigned to the device: n/a

How serious is the event: Medium

What has Sophos done so far: There weren't taken any actions.

What you need to do: -

_____________________________________________________________________

Time: 20:04

Sophos Central event details for 1234567 - My Company

What happened: Firewall connection to Sophos Central interrupted

Where did it happen: S3RI4LNUMB3R_2

User assigned to the device: n/a

How serious is the event: High

What has Sophos done so far: No further action has been taken.

What you need to do: Check if the ISP used by the gateway is reporting any problems or outages.

___________________________________________________________________________________________

Time: 20:04

Sophos Central event details for 1234567 - My Company

What happened: Firewall connection to Sophos Central interrupted

Where did it happen: S3RI4LNUMB3R_1

User assigned to the device: n/a

How serious is the event: High

What has Sophos done so far: No further action has been taken.

What you need to do: Check if the ISP used by the gateway is reporting any problems or outages.

_____________________________________________________________________________________________

Dear Administrator,

You are receiving this auto-generated message from Sophos Notification System to inform Change in HA Status.

Mode: Active-Passive
Hypervisor assigned MAC addresses: Disabled
Preferred Primary: S3RI4LNUMB3R_1 (Node1)
Cluster ID: 0
Dedicated Port: Port8
Monitoring Ports:
Time: 20:05:54 PM, Feb 12, 2024

Serial Number (Node Name)

Model Number

Firmware Version

Current State

Administration IP

S3RI4LNUMB3R_1 (Node1)

XGS2100

SFOS 19.5.3 MR-3-Build652

Auxiliary

PortMGMT (10.0.1.5)

S3RI4LNUMB3R_2 (Node2)

XGS2100

SFOS 19.5.3 MR-3-Build652

Primary

PortMGMT (10.0.1.1)

______________________________________________________________________________________________________

Dear Administrator,

You are receiving this auto-generated message from Sophos Notification System to inform Change in HA Status.

Mode: Active-Passive
Hypervisor assigned MAC addresses: Disabled
Preferred Primary: S3RI4LNUMB3R_1 (Node1)
Cluster ID: 0
Dedicated Port: Port8
Monitoring Ports:
Time: 20:06:46 PM, Feb 12, 2024

Serial Number (Node Name)

Model Number

Firmware Version

Current State

Administration IP

S3RI4LNUMB3R_1 (Node1)

XGS2100

SFOS 19.5.3 MR-3-Build652

Standalone

PortMGMT (10.0.1.1)

S3RI4LNUMB3R_2 (Node2)

XGS2100

SFOS 19.5.3 MR-3-Build652

Fault

PortMGMT (10.0.1.5)

______________________________________________________________________________________________________

And after that just three more mails between 20:10 and 20:11 that basically inform me about everything being fine again.

I don't find anything particularly helpful in the logs, just this in the System log:

SYSTEM
2024-02-12 20:04:35
Interface
                  
Interface DMZ is Up
17813
SYSTEM
2024-02-12 20:04:35
Interface
Interface WIFI is Up
17813
SYSTEM
2024-02-12 20:04:34
Interface
Interface External is Up
17813
SYSTEM
2024-02-12 20:04:34
Interface
Interface HA link is Up
17813
SYSTEM   
2024-02-12 20:04:34   
Interface   
Interface LAN is Up
17813
SYSTEM
2024-02-12 20:04:31
HA
Interface Port8 went down. Appliance HA state BACK                                                                       
60023
SYSTEM
2024-02-12 20:04:31
Interface
Interface HA link is Down
17813
SYSTEM
2024-02-12 20:04:30
Interface
Interface DMZ is Down
17813
SYSTEM
2024-02-12 20:04:30
Interface
Interface WIFI is Down
17813
SYSTEM
2024-02-12 20:04:30
Interface
Interface External is Down
17813
SYSTEM
2024-02-12 20:04:29
Interface
Interface LAN is Down
SYSTEM   
2024-02-12 20:06:06        
Interface   
Interface HA link is Down
17813
SYSTEM
2024-02-12 20:05:54
HA
Successful 
Appliance with appliance key 'S3RI4LNUMB3R_1' and node name 'Node1' becomes auxiliary at appliance startup
60018
SYSTEM
2024-02-12 20:05:24
Interface
Interface xfrm1-Example is Up
17813
SYSTEM
2024-02-12 20:05:17
Appliance
Appliance started successfully.
SYSTEM   
2024-02-12 20:06:46   
HA            
Successful 
Appliance with appliance key 'S3RI4LNUMB3R_1' and node name 'Node1' becomes standalone  
60012
SYSTEM   
2024-02-12 20:08:09   
Interface   
                  
Interface HA link is Up

I have no idea why this happens, has anyone any idea?



Edited TAGs
[edited by: Erick Jan at 8:11 AM (GMT -8) on 13 Feb 2024]
Parents Reply Children
No Data