Firewall Connection Lost in Sophos Central

Hello Community,

The issue is marked as Fix as of 8:00am PT, 5:00pm CEST.

Regards,

It happened again today, 7 times for 3 different customers in the last hour.

All Central-01 (Frankfurt)? 

Yes

Same issue here with our auxillary firewall. 

I can confirm, several customers, all within Germany. I updated the case

Problem is not fixed, several Customers within Central Frankfurt

Hi Lucar,

it`s not fixed.

Our Case ID 05794975 

BR Gerd

same here.

Received a bunch of alert mail, this morning again. Firewalls still showing as disconnected in log.

2022-10-19 08:51:41Z INFO central-connect[23154]:221 main:: - Polling for SSO to PIC-URI [https://utm-cloudstation-eu-central-1.prod.hydra.sophos.com]/sophos/api/v1/firewalls/C420xxxx0F/sshTunnel  Timezone: Europe/Berlin
2022-10-19 08:51:41Z INFO central-connect[23154]:271 main:: -  got response of poll for SSO. Status: disconnected backupExpected:
2022-10-19 08:52:11Z INFO central-connect[24424]:221 main:: - Polling for SSO to PIC-URI [https://utm-cloudstation-eu-central-1.prod.hydra.sophos.com]/sophos/api/v1/firewalls/C420xxxx0F/sshTunnel  Timezone: Europe/Berlin
2022-10-19 08:52:11Z INFO central-connect[24424]:271 main:: -  got response of poll for SSO. Status: disconnected backupExpected:

"got response of poll for SSO. Status: disconnected" logged permanently.

Should be connected, I guess. At least yesterday there  were some lines showing connected.

2022-10-18 12:20:25Z INFO central-connect[23376]:221 main:: - Polling for SSO to PIC-URI [https://utm-cloudstation-eu-central-1.prod.hydra.sophos.com]/sophos/api/v1/firewalls/C420xxxxx0F/sshTunnel  Timezone: Europe/Berlin
2022-10-18 12:20:30Z INFO central-connect[23376]:271 main:: -  got response of poll for SSO. Status: connected backupExpected:

The poll request is for SSO. Essentially if you want to login to the firewall from Central (SSO), the firewall will poll this request (Therefore you see this 1/6 attempt to login). This should not be related to the issue you are seeing here. 

In log viewer / Central audit you should see somebody using the SSO on 12:20 (UTC+0) for this firewall. 

yes, it was me yesterday. Thanks for pointing that out. So SSO here is for active remote administration from Central.

Hello,

same here, different customers (some with HA Clusters) at: 12:24, 12:28, 12:30, 12:33, 12:42, 12:51, 13:09, 13:11, 13:27

Our monitoring did not report any disconnections, I was also connected in some environments when the messages came. The connections were not disconnected.

Best regards

Michael

Hello,

same here, different customers (some with HA Clusters) at: 12:24, 12:28, 12:30, 12:33, 12:42, 12:51, 13:09, 13:11, 13:27

Our monitoring did not report any disconnections, I was also connected in some environments when the messages came. The connections were not disconnected.

Best regards

Michael