Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 43 subscribers
  • Views 3822 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Missing Firewalls on Central + Stopped Services

Nanoman

Hi!

tonight the HA-Cluster disconnected from Central (not together: the AUX 1h later) and on the Firewall the following services are shown as "stopped":
- fwcm-updaterd
- fwcm-heartbeatd
- fwcm-eventd
- fwcm-api-execut

By the way, only one of the two FWs of the cluster is shown on Central.
Putting the cluster in a new group on Central does not help.
Disabling Central-Management from the FW does not work.

XGS2300 (SFOS 20.0.0 GA-Build222)

I honestly don't know what to do. Any ideas?
Thanks in advance.



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Manawapriya Thenuwara

    After starting, check the Log Files: 

    https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/LogFileDetails/index.html

    Interesting: hbtrust.log

    __________________________________________________________________________________________________________________

  • 0 in reply to Manawapriya Thenuwara

    I contacted the Support and this procedure fixed the issue:

    1. Remove the firewalls from Central
    2. De-register the central account from the Firewall
    3. open putty 
    4. select option 5 ( device management ) and then 3  (Advanced shell )
    5. Run the below commands one by one to restart the service.

    service fwcm-updaterd:restart -ds sync     
    service fwcm-heartbeatd:restart -ds sync  
    service fwcm-eventd:restart -ds sync      

    6. Re-register your firewall cluster with Sophos Central.

    Regards

  • 0 in reply to Nanoman

    HI,

    Did Sophos Support indicate why this happened? 

    We are experiencing the same issue with one of our firewalls at a remote location about 2 hours away.

    Last Monday at around 8:19am, it just suddenly stopped talking to Sophos Central for no reason almost 2 weeks after updating it to FIOS 20.0.

    Support at first suggested removing the firewall from Sophos Central and re-registering it, but I insisted I wanted to know the cause of the issue before I attempt something like that.

    Support has been examining the logs from the firewall and are supposed to contact me by end of day today.

    Really don't want to have to remove it from Central and all of those other steps and I am concerned that this might happen with our other firewalls now that we have updated them to FIOS 20.0

    This is the second firewall we have had service related issues with since updating them to FIOS 20.0. 

  • 0 in reply to Randy Cleveland

    Unfortunately, I was not told why this happened.
    However, the problem does not solve itself and you have to perform the above procedure to solve the issue.
    I can tell you, however, that the deregistration process does not cause any problems and is done in a couple of minutes.

    P.S. If support tells you why the problem happened, post it here Slight smile

  • 0 in reply to Nanoman

    It seems I will not know the cause of the issue.

    The response I got from Sophos pretty much said that they didn't download the firewall logs in time to view the logs from the day the issue happened. The logs they downloaded did not contain the logs for the day the issue occurred any longer.

    They looked at the Sophos Central logs as well and saw:

    2024-03-18 11:44:03Z ERROR Tools.pm[29260]:97 SFOS::Common::Central::Tools::report_status - ETIMEOUT: The operation timed out, please try again later. 
    2024-03-18 20:21:25Z FATAL central-refresh[5920]:67 main:: - Seems that we got called by accident since we are not registered. Exiting.

    Looks like I am going to have to follow the steps to remove it from Central and re-add it. 

Unfiltered HTML