This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Firewall Communication to Sophos Central

Hi,

We have a Sophos XGS107 firewall on a Spectrum cable internet connection.

Yesterday mid-morning, we got a notification that the firewall had lost communication to Sophos Central.

We called the location where the XGS107 is located and they were not having any issues accessing the internet.

I did a remote session with one of the systems there and looked at the firewall through the local web interface, and it was reporting no issues locally.

So we told the firewall to reboot to see if that fixed the issue, and it did not.

My only guess is that there is an issue on Spectrum's end somehow, so I will need to call them.

My question is this:

What TCP/IP ports do Sophos Firewalls use to communicate with Sophos Central? I may need to know this information when talking to Spectrum.

I have not been able to locate this information on the forums or online yet.

Thanks for any information.

Randy

This thread was automatically locked due to age.

Top Replies

Randy Cleveland 7 months ago in reply to Vivek Jagad +2 suggested

Seems my answer lies in this post: Missing Firewalls on Central + Stopped Services Sophos Supoort has not officially replied to me with this solution, and they did not download the firewall logs in…

Parents

0 Vivek Jagad 8 months ago

Hello Randy Cleveland ,

Thank you for reaching out to the community, please refer Domains and ports to allow.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Randy Cleveland 8 months ago in reply to Vivek Jagad

Hi,

Thank you for the link, but it hasn't helped much.

If all firewall communication occurs on port 443, then Spectrum can't be blocking that port, as web browsing on 443 from the clients at this site is working normally.

Spectrum re-booted the cable modem at this site, and that did not solve the issue.

I'm beginning to suspect an issue with FIOS 20.0.0 GA-Build222.

We had another firewall (XGS107W) that we updated to FIOS 20.0.0 and the WiFi service stopped and would not restart without Sophos Support assistance.

I'm beginning to wonder if the service that communicates with Sophos Central has stopped working.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Randy Cleveland 8 months ago in reply to Vivek Jagad

Hi,

Thank you for the link, but it hasn't helped much.

If all firewall communication occurs on port 443, then Spectrum can't be blocking that port, as web browsing on 443 from the clients at this site is working normally.

Spectrum re-booted the cable modem at this site, and that did not solve the issue.

I'm beginning to suspect an issue with FIOS 20.0.0 GA-Build222.

We had another firewall (XGS107W) that we updated to FIOS 20.0.0 and the WiFi service stopped and would not restart without Sophos Support assistance.

I'm beginning to wonder if the service that communicates with Sophos Central has stopped working.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Vivek Jagad 7 months ago in reply to Randy Cleveland

Hey Randy Cleveland ,

You can check the services status under the console> system diagnostics show subsystem-info

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog 7 months ago in reply to Vivek Jagad

Ocassionally you will see such issues, that Cental reports Firewalls disconnected. Sometimes it is false positive. There have been waves of such issues.

What you did not write is, if the fiewalls were shown as disconnected in Central or if it was only the alert mail.
Cancel
Vote Up 0 Vote Down

Cancel
0 Randy Cleveland 7 months ago in reply to LHerzog

It's not a false positive. The firewall has not contacted Sophos Central since the first notification on Monday morning.
Cancel
Vote Up 0 Vote Down

Cancel
0 Randy Cleveland 7 months ago in reply to Vivek Jagad

Hi,

Thank you so much for that information.

I haven't had to access the console until recently with the SSD firmware updates we neede to do to some of our firewalls.

Which service would I be looking for? Most of then say RUNNING or UNTOUCHED. The LoggingDaemon is in a STARTING state though.

And I am seeing in the System logs "The audit system has successfully shut down" over and over..

I have started a support ticket for the issue, since it appears to be an issue with the firewall itself.
Cancel
Vote Up 0 Vote Down

Cancel
0 colly72 7 months ago in reply to Randy Cleveland

We're seeing the same issue today. Also very slow accessing Sophos Central and also issues with App Control blocking whitelisted apps.
Cancel
Vote Up 0 Vote Down

Cancel
0 Raphael Alganes 7 months ago in reply to Randy Cleveland

Hello Randy Cleveland ,

Regret to hear you bumped into an issue. Could you let us know the caseID of your opened support case with us?

Many thanks for your time and patience and thank you for choosing Sophos.

Regards,

Raphael Alganes
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
+1 Randy Cleveland 7 months ago in reply to Vivek Jagad

Seems my answer lies in this post:

Missing Firewalls on Central + Stopped Services

Sophos Supoort has not officially replied to me with this solution, and they did not download the firewall logs in time to identify the root cause of the issue.
Cancel
Vote Up +2 Vote Down

Cancel