Manage XG with Central

James at this time the Central Management EAP is only open to Central accounts in the AWS EU-West-1 availability region. Is your Central Account in that region? If so can you PM me your Central account details and I'll see if we can get you added to the CM EAP.

Stuart

Also got an EU West 1 Dashboard I would like to get enabled. When will this be made global and be an option in the EAP system?

Emile

Please try the following steps:

Deregister the XG from Central by removing it. Click the ... on the far right if the firewall is listed.

In the XG webadmin console, try to turn off Central Management. If you get an error and it doesnt switch off, please deregister completely all Central functions.

Wait 10 or 20 seconds. If you had to deregister Central functions please now re-register, if you didn't try to add Central Management by clicking the slide control.

At this point go to the Central UI, your XG should be listed. Don't click the Add Firewall button - its not working yet. The firewall should be listed and it should say Connected on the left hand side. On the right hand side under some placeholder text you should see a link Accept Management. Click that.

The XG should now be connected to Central. Try clicking on the XG name/serial link.

Let us know if this helps.

Dear Stuart

I am having same isssue.I have done the procedure as described but getting error as per the screen shot.

Please help.

BR

VishvasChitale.docx

Try to SSH into the XG and enter the Advanced Shell.

XG135w_XN03_SFOS 17.5.0 Beta-2# ps -w | grep ssod

ssod             1396  1344 root     21348  9464 S    {ssod} csc -L 3 -c /_conf/cscconf.bin

ssod            10473  1396 root     87768  1992 S    ssod -f /cfs/ssod.conf

grep            17533  9389 root     12392   688 S    grep ssod

In the example above:

XG135w_XN03_SFOS 17.5.0 Beta-2# kill -9 10473

Wait 20-30 seconds and then try to click the link in Central for the firewall.

Let me know if this works.

I removed and added the XG.
Now it looks like this and I can't click anything now.

 You need to click Accept Management on the right hand side.

after clicking to Accept Management, i can click on the serial. but: 

So, now please go through the second comment I made re killing the ssod

all right, you have to wait until after 5-10 minutes a mail arrives.
Now it works ! 

Dear Stuart

I have killed the process  and now I am  getting login screen at this URL https://fw-sso.0101.fw.prod.hydra.sophos.com/webconsole/webpages/login.jsp

then i am getting prompted for User name and password ,then I am getting disclaimer screen and when I accept the disclaimer then system is going  again back to login in screen.

I am using password of the admin user .Please help.

BR

Vishvas

Log out of Central. Then log into your account and go to Firewall Management, then Firewalls.

Then click on your firewalls serial number/name - you should get a splash screen and then the UI of your firewall.

Let us know

Log out of Central. Then log into your account and go to Firewall Management, then Firewalls.

Then click on your firewalls serial number/name - you should get a splash screen and then the UI of your firewall.

Let us know

Dear Stuart

I have Relogged to central am getting my firewall UI. But after username and password I am getting Login in disclaimer and when I accept it , i am again getting login UI.

No improvement sir.

BR

Vishvas

We need to check your account. You should not be seeing a UI login screen at all - thats what SSO is for 

Leave this with me please, and thanks for your patience.

Stu

Hi Vishavas,

This issue was recently reported. The login disclaimer currently breaks the session handling during login, when it's enabled, and will be addressed in an update. 

Dear Alan

I have disabled the Login disclaimer settings then Central Manage is working.

Thanks for update.

BR

Vishvas

Dear Stuart

I have to kill everyday this process  ssod            10473  1396 root     87768  1992 S    ssod -f /cfs/ssod.conf .

Please help.

BR

Vishvas

issues related to the tunnel to central not reliably being established should all be fixed in the next 17.5 update, and we'll make some improvements in the next central update in a couple weeks. in the mean time, here are a few things to try, if you're seeing a "Something went wrong" popup:

Troubleshooting SSO not working, “Something went wrong” error
 
You might still get an error the first time you try to sso into the firewall. Just wait 10-20 second, and try again, while the firewall establishes a connection to Central.
 
If it still fails after waiting some time, there are known issues around SSO currently, and primarily it can happen if the SSO daemon doesn’t restart properly. If that’s the problem, it’s just a matter of killing the ssod process, and letting it restart when needed:
 
Kill the ssod process (At the time of opening Firewall, it will start again)
1. Login to the ssh shell of the firewall, then select options 5, then 3, to open the advanced shell.
2. Run the following command to find the ssod process ID:
ps -w | grep ssod
3. You should see something like this, and in the
4. Example below, the process ID is '12345'ssod 12345 4312 root 83672 2044 R ssod -f /cfs/ssod.conf
5. Then type the following, replacing ‘12345’ with the number you find from the above command:
kill 12345
6. Alternately, rebooting the firewall will also resolve this problem, but will be more disruptive.
 
 
Finally, you can also try re-registering your firewall with Central,
1. Login to the firewall, and on the Central Synchronization page, click De-Register.
2. Then, re-register it with Sophos Central, entering your credentials, and waiting for the process to complete
3. Enable firewall management
4. In Sophos Central, click Accept Management