IP reputation stopped

Hello,

same thing here...

i was thinking that MR12 was stable, but it seems not !

[Updated - 6/4/2020]

Hi All,

The services (ctasd and ctipd specifically, which are used for email filtering only) were not disabled due to a security incident or risk.

On some firewalls, the anti-spam service was started & running even when email filtering was not in use - which consumed unnecessary resources.

This behavior was recently corrected and the service is now disabled when it’s not needed. The next MR release will fix the erroneous UI alert on the Control center dashboard. In the meantime, a device reboot will also clear this incorrect UI alert.

Regards,

[Updated - 6/4/2020]

Hi All,

The services (ctasd and ctipd specifically, which are used for email filtering only) were not disabled due to a security incident or risk.

On some firewalls, the anti-spam service was started & running even when email filtering was not in use - which consumed unnecessary resources.

This behavior was recently corrected and the service is now disabled when it’s not needed. The next MR release will fix the erroneous UI alert on the Control center dashboard. In the meantime, a device reboot will also clear this incorrect UI alert.

Regards,

Do you mean this service were disabled by Sophos without inform anybody because it could be another security breach? 

Can you please point us to the KB that shows this?

Also - why does the Services icon show orange on the front panel?  I've trained my team to know that his is a concern and to raise a ticket internally when they see it.  Now we can't use that as an indicator of trouble if you have indeed decided to make this change.

What about MR13 (if there is one) why not make the changes in that?

furthermore... if this is an expected action then why does a reboot clear it?

Update on this, I'm following up with internally with the product team to provide more information.

Regards,

Thanks for the clarification.  Will this make it into a KB?

Also - can you please advise how firewalls that have been running fine suddenly displayed this alert.  Did Sophos issue a hotfix to stop the services? If so - what hotfix?

It feels a little concerning that this has happened without any notice or advice from Sophos, and I'm trying to ensure my techs know what is good and what is not.  Without notification it makes it very hard to do so.

Thanks Flo, 

Appreciate it!

Hi All, 

Please find the below updated KB article for this. 

• Sophos XG Firewall: IP reputation service showing stopped

Thanks for that.  Glad it's documented :-)