Firewall lost connection to Sophos Central

Hi Jae Lupo 

My apologies for this inconvenience, this is related to the ongoing advisory:

• Advisory: Sophos Central - Some customers are receiving false positive XG Firewall connection alerts
  • Related advisory post on the community

Regards,

This has been going on for 2 weeks now.  This is not a solution but more of an acknowledgement of the problem.  Does anyone have a solution??  Thanks.

Hi Roger Thommen1 

Navigate to the Alerts section in your Sophos Central Admin > click on "Firewall has not checked in with Sophos Central for the past null minutes":

Hope that clarifies things better!

2 weeks passed, and Sophos only can ask user to disable the alert notice?

Another week has gone by with no solution yet? I've got one site which is constantly reporting this error. Others are fine.

What sort of ETA do you have? I don't want to disable the email alerts, they're only once a day or so and I can ignore them rather than having an issue later if the alerts aren't enabled and something else happens that I do need to be alerted about.

So I would like to know an ETA for resolution of this issue though??

Thanks,

MAtt

One week passed, and Sophos still have no idea about the issue?

Hey - We do have an idea about the issue. 

Our development team have been working on this. I appreciate that this isn't something that is convenient to yourself & others, but we are working on this.

The latest update I can see from development is discussing multiple routes for a solution as we have identified the problem & multiple solutions but we need to weigh this up with time worked, other impacts etc.

This is marked as critical on our end and we seem to be getting closer to a fix.

Apologies for the issues this has caused.

Does Sophos fix up the issue now?

Hi Community,

This Sophos Notification thread has been created to help provide updates related to this incident.

Here's the latest update:

Update 27-5-2019
The fix for this issue is planned to be included in the next Central update, which is tentatively scheduled for June 15th. Please continue to follow this article for the latest information.

Regards,

We are suffering from this issue since early May and we are very surprised to read that a solution is only planned for June 15th.  It's too long !

In the meantime, we receive alerts with high level of breach of security 2 times a day.  We become used (and a little bit fed up..) to receive such email and we don't pay anymore attention to it.  As a results, we don't pay attention to other mails coming as we believe it's always the same message regarding the lost connection to Sophos Central.  So, we could be at risk at a certain moment.

Can't you send a patch for those suffering from this ?

Kind regards,

Sébastien

OMG.

1. The complexity

2. The complexity

3. The points one and 2

OK, rant over.  Hopefully the team fixes this and we go on our way. Chill Pill.

Big thanks to those who commented.

All the best.

It is an issue in the Central Alerting system itself. 

So basically you cannot simply install a patch on your XG firewall. 

And such patches need to be carefully deployed because it affects all our customers. I understand the frustration about this issue. 

You can disable the email alerts in the meantime until this is fixed. 

It is an issue in the Central Alerting system itself. 

So basically you cannot simply install a patch on your XG firewall. 

And such patches need to be carefully deployed because it affects all our customers. I understand the frustration about this issue. 

You can disable the email alerts in the meantime until this is fixed. 

Eggg zack lee

LOL

RD

Thanks for answer.

A small question regarding your suggestion to disable the email alerts : can I disable just this specific alert or will it disable all alerts ?  If it's all, then I won't be alerted in case of other treath.

You can disable just this alert specifically, see my previous post here.

I do not have this option either!

All I see is Acknowledge and no option underneath it as shown in your post graphic

Can you verify this KBA? 

https://community.sophos.com/kb/en-us/132195

This should be new since 07.may 

https://docs.sophos.com/central/Readmes/en-us/scloud_readme.html

I checked a few of my clients and there is a "Configure email alerts" section under the Global Settings section in their cloud.sophos.com page. However the pulldown in the alert itself to tell it to stop is not there on any of them.

I found the Global Settings, Email Alerts but do not see the alerts specifically and editing them.

I see rules, but cant get beyond the first screen and not sure that's the right place anyway?

OK, figured it out.  In your partner portal, go to Settings & Policies. There is a setting there for Partner Control that is off. I turned it on and now that option shows up in the client's admin portal. I presume that means if I had logged into the cloud.sophos.com as the client and not gone through the partner portal it probably would have been there.

When I turn on, that gives the same screen that I see individually that I referred to earlier. Just you can set it where you describe and presume its the same for all clients.

But, still do not see how I can edit one specific alert. Can not find anywhere all the different types of email alerts?

OK - now I see the option individually within each customer. I guess that is what you were trying to say - my bad

Many thanks