firewall blocks client due to heartbeat - while the HB status is green <1> - why?

Our firewall rules with block clients with no HB and green HB only enabled, blocked this client today during the HB status on the firewall was reported as green.

I cannot see a reason - any idea? I don't like to create special rules for this client. The users reports such issues from time to time, and every time I checked it, the problem was like described below.

What can we do to get this solved?

here we can see firewall rules blocked due to HB status:

• hb_status="No Heartbeat"

The HB log shows

[2024-09-23 15:53:58.730Z] INFO EndpointStorage.cpp[26394]:119 endpoint_connectivity_cb - Connectivity changed for <27fde231-3860-4e3a-9d5b-d23d201bc43c>: <1> -> <3>
[2024-09-24 06:41:26.221Z] INFO EndpointStorage.cpp[26394]:119 endpoint_connectivity_cb - Connectivity changed for <27fde231-3860-4e3a-9d5b-d23d201bc43c>: <3> -> <1>
[2024-09-24 06:42:00.991Z] INFO EndpointStorage.cpp[26394]:119 endpoint_connectivity_cb - Connectivity changed for <27fde231-3860-4e3a-9d5b-d23d201bc43c>: <1> -> <5>
[2024-09-24 06:42:01.336Z] INFO EndpointStorage.cpp[26394]:119 endpoint_connectivity_cb - Connectivity changed for <27fde231-3860-4e3a-9d5b-d23d201bc43c>: <5> -> <1>
[2024-09-24 07:32:16.638Z] INFO EndpointStorage.cpp[26394]:119 endpoint_connectivity_cb - Connectivity changed for <27fde231-3860-4e3a-9d5b-d23d201bc43c>: <1> -> <5>
[2024-09-24 07:32:16.994Z] INFO EndpointStorage.cpp[26394]:119 endpoint_connectivity_cb - Connectivity changed for <27fde231-3860-4e3a-9d5b-d23d201bc43c>: <5> -> <1>
[2024-09-24 07:33:25.766Z] INFO EndpointStorage.cpp[26394]:119 endpoint_connectivity_cb - Connectivity changed for <27fde231-3860-4e3a-9d5b-d23d201bc43c>: <1> -> <5>
[2024-09-24 07:33:26.044Z] INFO EndpointStorage.cpp[26394]:119 endpoint_connectivity_cb - Connectivity changed for <27fde231-3860-4e3a-9d5b-d23d201bc43c>: <5> -> <1>

So between

06:42:01.336Z and

07:32:16.638Z

the HB status was 1 which is the "good" state. But during the whole time, the user was blocked by the firewall rules.

At 07:33:26Z / 09:33:26 CEST the issue was magically resolved. without doing anything.

the HB status flapped a few times between 5 and 1 and that all was good again.

The user/endpoint was allowed by the firewall.

That is frustrating.

Central events (note: today is Sept 24th)

        Sep 24, 2024 8:55 AM     Update succeeded    
        Sep 23, 2024 8:58 AM     Update succeeded    
        Sep 23, 2024 8:40 AM     Sophos Firewall X450xxx7E reported computer resumed sending heartbeat signals    
        Sep 23, 2024 8:09 AM     Sophos Firewall X450xxx7E reported computer not sending heartbeat signals    
        Sep 22, 2024 10:17 AM     Update succeeded

Client:

macOS Sonoma 14.7

Open Sophos Endpoint. Click About > Run Diagnostic Tool. Click Prerequisites. Check your permissions.

all permissions enabled