Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 2 subscribers
  • Views 6588 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM 9 Endpoint Protection-Endpoints will not update

smgastaroID
I enabled Endpoint Protection on my Sophos UTM 9. After installing the agent they fail to update. The Sophos AutoUpdate primary and secondary locations are blank. The options are grayed out and cannot be changed. I installed the agent on several endpoints and each behaved the same. Installs fine but will not update due to the AutoUpdate properties not populated with an update server address. Any suggestions would be appreciated.  Thank you!


This thread was automatically locked due to age.
  • 0
    What do you see in the 'Sophos LiveConnect - Registration' section on the'Advanced' tab?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to smgastaroID
    Sounds similar to this problem: https://community.sophos.com/products/unified-threat-management/astaroorg/f/59/t/55967

     - - - - - - - - - - - -

    Communities Moderator, SOPHOS
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0
    I tried the suggestions in the attached link. Did not resolve the issue. Still no updating.
  • 0 in reply to smgastaroID
    Just curious, what exact version is installed on the UTM? 9.???

     - - - - - - - - - - - -

    Communities Moderator, SOPHOS
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0
    Firmware version: 9.006-5

    Patter version: 45578
  • 0 in reply to smgastaroID
    Well, these Update Server problems are usually caused by the agent not beeing able to reach its broker server.
    So first we need your detailed Networking and Web filter setup.

    UTM directly connected to the internet? Which kind of connection (Cable, DSL, fibre, ...)?
    Some sort of ISP router in front of your UTM?
    Web filter enabled? If yes, Transparent or Standard mode?
    What does the EP log of your UTM say? Any errors logged?

    ----------
    Sophos user, admin and reseller.
    Private Setup:

    • XG: HPE DL20 Gen9 (Core i3-7300, 8GB RAM, 120GB SSD) | XG 18.0 (Home License) with: Web Protection, Site-to-Site-VPN (IPSec, RED-Tunnel), Remote Access (SSL, HTML5)
    • UTM: 2 vCPUs, 2GB RAM, 50GB vHDD, 2 vNICs on vServer (KVM) | UTM 9.7 (Home License) with: Email Protection, Webserver Protection, RED-Tunnel (server)
  • 0
    UTM directly connected to the internet? Which kind of connection (Cable, DSL, fibre, ...)?
    Cable connection. UTM is behind D-Link Router which is connected to ISP Cable Modem

    Some sort of ISP router in front of your UTM?
    See previous answer

    Web filter enabled? If yes, Transparent or Standard mode?
    Yes. Transparent Mode

    What does the EP log of your UTM say? Any errors logged?
    2013:05:14-07:42:58 SMGUTM9 epsecd[4804]: W id="4202" severity="warn" sys="System" sub="epsecd" name="Quit recieved from Sophos LiveConnect"
    2013:05:14-07:42:58 UTM9 epsecd[4804]: I id="4223" severity="info" sys="System" sub="epsecd" name="Closing socket to Sophos LiveConnect"
    2013:05:14-07:42:58 UTM9 epsecd[4804]: I id="4210" severity="info" sys="System" sub="epsecd" name="Sleeping for 300 seconds"
    2013:05:14-14:40:10 UTM9 epsecd[4804]: W id="4202" severity="warn" sys="System" sub="epsecd" name="Quit recieved from Sophos LiveConnect"
    2013:05:14-14:40:10 UTM9 epsecd[4804]: I id="4223" severity="info" sys="System" sub="epsecd" name="Closing socket to Sophos LiveConnect"
    2013:05:14-14:40:10 UTM9 epsecd[4804]: I id="4210" severity="info" sys="System" sub="epsecd" name="Sleeping for 300 seconds"
  • 0 in reply to smgastaroID
    If this is a business setup, please have your reseller open a ticket at sophos.
    For home setup, read along:

    UTM directly connected to the internet? Which kind of connection (Cable, DSL, fibre, ...)?
    Cable connection. UTM is behind D-Link Router which is connected to ISP Cable Modem

    That's quite problematic. How are packets handled between the D-Link router and UTM? Are all incoming packets forwarded to your UTM (Exposed Host or (fake) DMZ function)?

    Web filter enabled? If yes, Transparent or Standard mode?
    Yes. Transparent Mode

    Have you added DNS groups

    • all.broker.sophos.com
    • sxld.gdns.sophosxl.net
    • dci.sophosupd.com
    • d1.sophosupd.com
    • d2.sophosupd.com
    • d3.sophosupd.com
    • d1.sophosupd.net
    • d2.sophosupd.net
    • d3.sophosupd.net

    to "Skip transparent destination mode hosts/nets" under Wed Protection -> Web Filer -> Advanced?

    Just to test: Disable Web Protection, create a firewall rule on position 1 allowing Internal Network -> Service Any -> Any.

    Then uninstall the EP Software completely on one host, reboot, delete remaing Directories named "Sophos" under C:\Program Files, C:\Program Files (x86), C:\ProgramData and C:\All Users\Application Data. Redownload the full installer from WebAdmin and install it on that host.
    Does that work?

    What does the EP log of your UTM say? Any errors logged?
    2013:05:14-07:42:58 SMGUTM9 epsecd[4804]: W id="4202" severity="warn" sys="System" sub="epsecd" name="Quit recieved from Sophos LiveConnect"
    2013:05:14-07:42:58 UTM9 epsecd[4804]: I id="4223" severity="info" sys="System" sub="epsecd" name="Closing socket to Sophos LiveConnect"
    2013:05:14-07:42:58 UTM9 epsecd[4804]: I id="4210" severity="info" sys="System" sub="epsecd" name="Sleeping for 300 seconds"
    2013:05:14-14:40:10 UTM9 epsecd[4804]: W id="4202" severity="warn" sys="System" sub="epsecd" name="Quit recieved from Sophos LiveConnect"
    2013:05:14-14:40:10 UTM9 epsecd[4804]: I id="4223" severity="info" sys="System" sub="epsecd" name="Closing socket to Sophos LiveConnect"
    2013:05:14-14:40:10 UTM9 epsecd[4804]: I id="4210" severity="info" sys="System" sub="epsecd" name="Sleeping for 300 seconds"

    That's an error I got when EP was beta. The only way I could resolve it was to build my UTM from scratch without reapplying a config backup. (I believe it had todo with my UTM ID being messed up at the broker servers.)
    But try the suggestions above first... [:)]

    ----------
    Sophos user, admin and reseller.
    Private Setup:

    • XG: HPE DL20 Gen9 (Core i3-7300, 8GB RAM, 120GB SSD) | XG 18.0 (Home License) with: Web Protection, Site-to-Site-VPN (IPSec, RED-Tunnel), Remote Access (SSL, HTML5)
    • UTM: 2 vCPUs, 2GB RAM, 50GB vHDD, 2 vNICs on vServer (KVM) | UTM 9.7 (Home License) with: Email Protection, Webserver Protection, RED-Tunnel (server)
  • 0
    UTM is behind D-Link Router which is connected to ISP Cable Modem

    The standard suggestion here is to take the D-Link out so that the UTM can have the public IP on its External interface.  If the D-Link provides WiFi, then tape over its WAN port, disable DHCP and plug one of its LAN ports into your Internal network - voila, a wireless switch.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML