Being knocked out of Firewall management

We are managing our firewalls from Sophos Central. We will login to Sophos Central, go into firewall management and choose the firewall and start managing it. The timing is random, but in the midst of managing the firewall we will be kicked out of the firewall and have to go back in to it. This occurs in a little as two minutes, and the timing is random from there. Some days, like today it can occur 5-6 times an hour.

It is super frustrating and time consuming. Anyone have any ideas why?

Added TAGs
[edited by: Raphael Alganes at 2:30 PM (GMT -7) on 25 Apr 2024]

Top Replies

LuCar Toni 9 days ago in reply to April Beachy +1

Central SSO does not support multi user logins. There are improvements to get this working.

Parents

0 BrucekConvergent 10 days ago

Could be an issue with latency between the firewall and central (ISP related)... I'd suggest maybe starting a support ticket with Sophos to have them investigate, you can do that over at https://support.sophos.com

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 April Beachy 10 days ago in reply to BrucekConvergent

Multiple different Internet providers with over 200 Mbps up and down and less than half used, not likely to be ISP related latency.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent 10 days ago in reply to April Beachy

Then I would certainly start an official support case @ support.sophos.com

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PhilippRusch 9 days ago in reply to April Beachy

Hello April,

we had this with two redundant uplinks to two different providers. Turned out to be a load balancing issue. So we do not use load balancing between our lines and this doen't happen anymore

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 April Beachy 9 days ago in reply to PhilippRusch

That is a very valid point! We had the same issues load balancing, so we gave it up about a year ago. It gives me something to think about though.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent 9 days ago in reply to PhilippRusch

That would do it -- April if you are using such a load balancer, might contact Sophos regarding what to use for definitions if you decide to configure some "sticky" connections in your load balancers to get around this, if this is the issue.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 April Beachy 9 days ago in reply to BrucekConvergent

We are not using load balancing of any sort.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent 9 days ago in reply to April Beachy

Welp I guess back to starting an official sophos support case, they'll have to dig into this one.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 BrucekConvergent 9 days ago in reply to April Beachy

Welp I guess back to starting an official sophos support case, they'll have to dig into this one.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 PhilippRusch 9 days ago in reply to BrucekConvergent

Hello April,

I think this is much easier to solve: You are using implicit WAN load balancing when using more than one "active" uplink.

If you see those uplinks in your firewall's GUI under "Network / WAN link manager", then you notice a "Weight" attribute attached to each link. So the requests are distributed between the links set to "active" using that "weight" parameter.

We solved a problem like yours with going to the console / 4. Device Console and setting "Session Persistence - Connection Based" as the method to be used.

See here for further details:

https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Routing/Gateways/RoutingLoadBalancingWeights/index.html

https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/CommandLineHelp/DeviceConsole/Set/index.html#routing

(this used to be : https://support.sophos.com/support/s/article/KB-000038813?language=en_US , but has been moved)

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 April Beachy 9 days ago in reply to PhilippRusch

To be clear - we do not load balance. The multiple different providers are in regards to the multiple different firewalls that we manage.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PhilippRusch 9 days ago in reply to April Beachy

Yes , I know you said so, but did you check if your WAN uplinks are both "active"?

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PhilippRusch 9 days ago in reply to PhilippRusch

I mean like this:

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 April Beachy 9 days ago in reply to PhilippRusch

We do not use load balancing and both of the WAN links are not active.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PhilippRusch 9 days ago in reply to April Beachy

OK, I see, so I misinterpreted this!

Did see this message after writing the other.

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel