Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 38 replies
  • Subscribers 12 subscribers
  • Views 99552 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

9.4 Endpoint Web Protection is NOT working

RickDunsirn

I've noticed that after a clean install of 9.4, Endpoint Web Protection logs are not populating on my UTM and my endpoints (Windows 10) appear to be able to surf anywhere without any protection.  The Sophos Agent shows Web Control enabled, but it is not blocking sites that it's supposed to.  I'll reiterate, I have cleanly installed 9.400-9 and have refreshed from scratch the Endpoint Protection and I'm still seeing the issue (this was not an upgrade...after the upgrade, this failed as well, so I did everything from scratch and still see the issue).  My endpoints are showing up just fine under Endpoint Protection on the gateway and the antivirus appears to be working, just not the web protection.  Here is a sample of the Endpoint Protection Logs:

2016:03:25-10:11:27 rickshome epsecd[10282]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
2016:03:25-10:11:27 rickshome epsecd[10282]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="-1"
2016:03:25-10:13:15 rickshome epsecd[10282]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
2016:03:25-10:13:15 rickshome epsecd[10282]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="-1"
2016:03:25-10:15:03 rickshome epsecd[10282]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
2016:03:25-10:15:03 rickshome epsecd[10282]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="-1"
2016:03:25-10:17:46 rickshome epsecd[10282]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
2016:03:25-10:17:46 rickshome epsecd[10282]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="-1"
2016:03:25-10:19:04 rickshome epsecd[10796]: I main::_log:435() =>  severity="info" sys="System" sub="eplog" name="curl_base_url: e53611b9-7d74-339e-b3f2-4e2addb92ca2-wdx-7d74.broker.sophos.com/.../"
2016:03:25-10:19:34 rickshome epsecd[10282]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
2016:03:25-10:19:34 rickshome epsecd[10282]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="-1"
2016:03:25-10:19:35 rickshome epsecd[10282]: I id="4233" severity="info" sys="System" sub="epsecd" name="Sending data to Sophos LiveConnect to sync UTM Web Policy Changeset"
2016:03:25-10:19:38 rickshome epsecd[10282]: I id="4213" severity="info" sys="System" sub="epsecd" name="User triggered changes in webadmin"
2016:03:25-10:22:21 rickshome epsecd[10282]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
2016:03:25-10:22:21 rickshome epsecd[10282]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="-1"
2016:03:25-10:23:16 rickshome epsecd[10282]: I id="4233" severity="info" sys="System" sub="epsecd" name="Sending data to Sophos LiveConnect to sync UTM Web Policy Changeset"
2016:03:25-10:23:19 rickshome epsecd[10282]: I id="4213" severity="info" sys="System" sub="epsecd" name="User triggered changes in webadmin"
2016:03:25-10:24:12 rickshome epsecd[10282]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
2016:03:25-10:24:12 rickshome epsecd[10282]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="-1"

I do see the reports coming in, but I'm a little bit concerned on the "-1" for acknowledgement.

Any ideas on what I can do next?  If you need more information, please let me know!


This thread was automatically locked due to age.
  • 0 in reply to AzRoN

    Hello, I referenced this thread in my case with sophos that has been open for several months before I was able to test 9.4.

    I was able to update to 9.401-11 over the weekend. My web filtering started back functioning, as well my endpoints were reporting correct status. Previous to this update if web filtering was on, it would work for awhile then stop and the endpoints would report SAV policy out of date.

    Well after 9.401-11 it worked for 2 days. Now there are no logs to be viewed of urls being visited today and believe me that setting is checked.

    I just wanted to give you guys some hope as I have been following up with the great team at sophos chasing this down.

    I will update to 9.402-7 and see if anything happens and fill you in tomorrow afternoon.

    Thanks!

  • 0 in reply to DustinWeathers
    Firmware version: 9.405-5

    I still did not work ...
    there are no files in a folder: C:\ProgramData\Sophos\Web Control\Policy

    Need Help...

  • 0 in reply to VladimirChalnik

    sophos home It works very well.

    but UTM + agent not work..

    who faced? any ideas ?

  • 0 in reply to VladimirChalnik

    Bump...we decided to try this again and it still does not work.  Web protection in the Endpoint Security and Control version 11.0.11 UTM using 9.503 UTM still does not work (I'm on the Windows 10 Fall Creator's update 2017).  I'm surprised this is still not working after all these years.  Is anyone aware of this?

  • 0 in reply to RickDunsirn

    What do you mean by "NOT working" - filtering doesn't occur? - antivirus not being applied? - logging does not appear on the endpoint device?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Web filtering doesn't work (all sites are allowed on the endpoint) and endpoint web filter logs are not populating on the UTM (no logs appear).  I am just talking about Endpoint Web Protection, not antivirus/malware.

  • 0 in reply to BAlfson

    The swi_service.exe process (Sophos Web Intelligence service) is responsible for downloading the policy fragments to the endpoint.

    To enable the logging of this, stop the Sophos Web Intelligence service.

    In Regedit, navigate to:

    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\Web Intelligence

    Create a new DWORD called LogLevel and set the value to 3

    Start the service, wait a minute then look at the logs under \windows\temp\

    There should be a service log called swisdiag,log which should contain reference to downloading the fragments.

    Remember to delete/rename the LogLevel DWORD registry entry and re-start the service as those logs can grow pretty quickly.

    Regards,

    Jak

  • 0 in reply to RickDunsirn

    Rick, show us the Edit of the Web Filtering Profile that should apply to an Endpoint but doesn't.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML