UTM 9.213-4 - Sophos LiveConnect for EndPoint - no computers are showing online

Now there is a new error appearing (mixed with the timeout error).

2016:03:10-17:11:36 fw epsecd[5037]: W main::_log:435() => severity="warn" sys="System" sub="eplog"
name="Listing [https://c87e5467-f30d-3cb0-893d-25f6c86d208a-wdx-f30d.broker.sophos.com//c87e5467-f30d-3cb0-893d-25f6c86d208a/]
failed with return code 35: SSL connect error Unknown SSL protocol error in connection to c87e5467-f30d-3cb0-893d-25f6c86d208a-wdx-f30d.broker.sophos.com:443

I also get tons of DNS errors in the Web-Filter, because of the IPv6 hostnames used that of course do not resolve on my network (IPv6 is disabled in my configuration).

2016:03:10-09:49:35 fw httpproxy[5128]: id="0003" severity="info" sys="SecureWeb" sub="http"
request="(nil)" function="parse_address" file="util.c" line="464" message="getaddrinfo:
2016:03:10-09:49:35 fw httpproxy[5128]: id="0003" severity="info" sys="SecureWeb" sub="http"
request="(nil)" function="parse_address" file="util.c" line="464" message="getaddrinfo: passthrough6.fw-notify.net: Name or service not known"
2016:03:10-09:49:35 fw httpproxy[5128]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="confd_config_filter" file="confd-client.c" line="3616" message="failed to resolve passthrough6.fw-notify.net, using 2a01:198:200:680::8080": Name or service not known" 2016:03:10-09:49:35 fw httpproxy[5128]: id="0003" severity="info" sys="SecureWeb" sub="http"
request="(nil)" function="confd_config_filter" file="confd-client.c" line="3616"
message="failed to resolve passthrough6.fw-notify.net, using 2a01:198:200:680::8080"

These are clearly bugs and not configuration or setup issues. None of the web-filter policies currently work.It seems that this bug is only triggered under special circumstances as the forum would be full of complains if that happened to everybody.

I think I will have to downgrade the system, this firmware seems to be a dead end for me.

Martin

Hi, Martin and Rick, and welcome to the UTM Community!

I think the UTM is "chatty" when it comes to the logs, so I wouldn't worry about  the IPv6 errors.

What happens if you disable 'Web Control' in Endpoint for one of the missing computers - does it show as green about 10 seconds later?

Cheers - Bob

Hi Bob!

actually all the endpoints are (mostly) green, only sometimes they are grey even if they are online, but I could not confirm that this related to all these error events. If it 's like you say and the UTM is chatty then it may be unrelated. For the IPv6 events I would agree that this does not sound like a big issue, but what about all these SSL errors?

I tried to switch web control on and off several times but it does not make a difference.

My actual issue is that the webfilter policies do not work any more, i.e. web access is completely open and the clients can surf wherever they like although the endpoint agent app says that web control is enabled.

Cheers

Martin

I have the same issue. In the log I am getting failed with response code 403: No error SSL connection timeout

If I try to go to the web address it says cert error.

Hi, Mark, and welcome to the UTM Community!

At least two different problems were discussed above.  Please show a copy of the log line.  What web address?

Cheers - Bob

Hi,

i have still the same issues with utm version 9.4xxxx.

My endpoints ar getting new policys like tamper protection password changes,... but my changes in the web control will be not published to the broker server. When i set warning for gaming sites in the webfilter policy for my endpoint, the utm warns me when my endpoint is behind the utm, but when my endpoint is not behind the utm i can surf without warnings on the gaming sites.

In the endpoint log of my utm the following error appears:

2016:05:01-22:32:11 utm epsecd[5964]: |=========================================================================

Just to give you an update:

I could not solve the issue with the non working web control policy and I finally gave up (i.e. I left the configuration unchanged and accepted that this does not work).

After some weeks, suddenly and out of the blue, the policy started working again and blocked the google.com domain because I had used this URL for testing purposes before I gave up. And I really mean *no* config changes whatsoever on my side that could have triggered this.

My google test policy turned out to be a very bad idea, because I could not switch it off again (the change was not propagated back to the clients - at least not within several hours that I tried to fix the issue). So I ended up with having to uninstall all endpoint clients to get google working again. Sorry guys, but whatever the problem was, it is not an acceptable behaviour that policies are propagated at random.

Martin