Unable to Categorize

Good morning

I think I've found the problem and I need you to help me.

The problem is that Sophos Firewall XG performs the query to the database categorization. The problem is that I have double NAT and I need the answer to that query back to UTM.

In this case I need to know the URL, IP and ports used by Sophos Firewall XG to consult the category of the web.
Thus it would create a rule that these queries are redirected to Sophos Firewall XG

Thank you very much

I'm experiencing exactly the same issue on a brand new installation running SFOS 15.01.0 MR-2. Most URLs are reported as uncategorized but a few (like google.com) do show up with categories. My XG has a public IP on the WAN interface and is able to ping sophos.com so I think Internet connectivity should be great.

I eventually rebooted the box and that seems to have fixed the issue.

Hello Diego,

Yes, you are correct. Sophos XG uses cloud based web categorization where in XG tries to contacting to the could server querying for the category belongs to the requested URL.

Here is the URL and the port no for the categorization server that XG connects to :

URL :

primary.wing.sophosxl.net
peak.wing.sophosxl.net

Port No :
80, 443, 6060, 6061

Please ensure that the XG is able to communicate to the above URL when you perform the URL Lookup from System > Diagnostics > URL Category Lookup.

Regards & Thanks,

Axar Patel

I was having the same problem. Last week filtering worked perfectly. Suddenly this week many bad sites were not being filtered. I rebooted the box a few minutes ago and now it's working correctly.

I'm working with the same problem 

/log/nSXLd.log

[2018-09-04 15:22:02] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files
[2018-09-04 15:22:02] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files
[2018-09-04 15:22:02] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files
[2018-09-04 15:22:02] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files
[2018-09-04 15:22:02] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files
[2018-09-04 15:22:02] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files
[2018-09-04 15:22:02] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files
[2018-09-04 15:22:02] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files
[2018-09-04 15:22:02] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files
[2018-09-04 15:22:03] <1994557376> [error] nSXLd: Unable to create socket because: Too many open file

[2018-09-04 15:22:03] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files
[2018-09-04 15:22:03] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files
[2018-09-04 15:22:03] <1994557376> [error] nSXLd: Unable to create socket because: Too many open files

any ideia to solve this problem ?

CR100iNG (SFOS 17.0.8 MR-8)

the firewall is able to go to internet 

ping peak.wing.sophosxl.net
PING peak.wing.sophosxl.net (52.26.29.75): 56 data bytes

ping primary.wing.sophosxl.net
PING primary.wing.sophosxl.net (52.28.130.115): 56 data bytes

MR-8# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=122 time=29.893 ms
64 bytes from 8.8.8.8: seq=1 ttl=122 time=29.633 ms
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 29.633/29.763/29.893 ms
CR100iNG_CA01_SFOS 17.0.8 MR-8# ping www.google.com
PING www.google.com (172.217.30.36): 56 data bytes
64 bytes from 172.217.30.36: seq=0 ttl=55 time=22.436 ms
64 bytes from 172.217.30.36: seq=1 ttl=55 time=21.773 ms
^C
--- www.google.com ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 21.773/22.104/22.436 ms

thanks in advanced

I have seen this once before on an *very* unstable Internet connection, I assumed at the time that the SXL service was spawning a connection when doing a category lookup which died when the connection went down, then when it came back up again tried again without cleaning up.

A reboot fixed it along with getting the ISP to sort out the fibre connection.

Not sure if that's of any help. This might have been fixed in later releases, I've not seen it since.

Please note the "Too many open files" was a bug that was resolved in 17.1

If anyone is running the latest release and still has problems with categorization, please let us know.

I am having the URL "Unable to categorize" problem on a replacement RMA XG310 (SFOS 17.5.3 MR-3) appliance.