Advisory: Support Portal Maintenance. Login is currently unavailable, more info available here.
For several weeks, we stopped seeing this error come through our Alerts.
Now once again, we are seeing this alert come in.
Has there been another change to Sophos Central which is sending out the false positives? I continually monitor our network activity and I do not see anything
that our service provider has done to cause this issue.
Any information would be great.
How often is this happening and are the firewalls in a high-availability cluster?
Timeline for the Message:
This week (2x)-> Monday and Yesterday and Today
Last Week (4x) -> Monday, Wednesday, Friday, Saturday
Week Prior (4x) -> Tuesday, Thursday, Friday, Saturday
We are running Active-Passive HA on Sophos 17.5-MR7
Those alerts should only generated, if one XG (per XG) is offline for 24h.
So if you have 3 XGs in Central:
XG2: offline since 5 Minutes
XG3: Offline since 3 Days.
You should get 1 Alert per Day.
Until XG2 reaches the Threshold of 24 Hs, then you will get 2 per Day.
Both are online.
Can you check the hbtrust.log?
It says FATAL Certificate.pm SFOS::HBtrust::Central::Certificate::certificate_refresh.
Could this be because the Auxiliary is currently running the firewall instead of the primary?
No - i would guess related to this: https://community.sophos.com/kb/en-us/127642