Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Replies 9 replies
  • Subscribers 0 subscribers
  • Views 902 views
  • Users 0 members are here
Options
Suggested

[9.165][QUESTION] Web control question

MarkMurphy
I have a VM version of the Beta 9.165-15 installed to test and have a question about Web control feature in the End Point Protection section. I have enable the feature and enabled the feature in the group that my clients use. As you can see in the firewall settings attachment the web control is enabled but on the Client attachment it still shows Disabled. Are there both the same settings and is there an issue? I would have thought that the clients would update from the group they are assigned and turn that on.
  • 0
    It will take some time to let the client sync the new settings. 
    Can you have a look at your client if the configuration is synced now?
  • 0
    Snowcrash, Thanks for the response. No the clients still show disabled. It has been several days now.
  • 0
    Just to double check (the Doh! factor) - is the computer a member of "My Group".  Is the Endpoint Group used by any of the Profiles?

    Can you check if any errors have been logged, View Log Files, Endpoint Protection.

    In order to check if this is a problem with Sync or a problem with Web Control, can you please try disabling Device Control.  Wait for 30 minutes - if the client has not updated then it a problem with sync in general.

    Note: There is nothing new in 9.2 that should affect this.

    Also can you post your UTM ID (found on the Computer Management Advanced tab).
  • 0
    Michael, I only have the one group "My Policy" All my endpoints are part of that group. I will disable the device control and let you know. I do not see any errors in the endpoint log. Here is the UTM ID  8690f3da-ee84-31e8-a0e5-248535498a38
  • 0
    Micheal, Disabling device control does not seem to do anything on the clients. Seems like you said Sync is not working. Don't know where to go from here as I can't say if this was working before installing the Beta and enabling Web control. I thought this Web control was new in this release as I never noticed it before in the 9.1 versions. so I never tried it before
  • 0
    Endpoint was added in 9.0
    Endpoint Web Control was added in 9.1

    We will look at your UTM on the cloud server side to see if we can see anything.

    Two more things:  In the GUI does it show your computer, does it show that it is connected?

    Can you please post a sample of the Endpoint Protection logs.
  • 0
    Also, did you take a 9.1 system and upgrade it, or did you install 9.1 fresh and then restore a backup from 9.2?
  • 0
    Yes they all show up in the Web GUI under endpoint protection as connected and OK

    The install was fresh with a restore from 9.106. Below is a sample of the logs.
    2013:11:06-06:51:16 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,9239065,25081670,25648362,26491712,28790456"
    2013:11:06-06:53:04 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-06:53:04 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,28790456"
    2013:11:06-06:53:57 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-06:53:57 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25081670,26491712,28790456"
    2013:11:06-06:54:50 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-06:54:50 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,25081670,25648362"
    2013:11:06-06:55:44 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-06:55:44 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25648362,26491712,28790456"
    2013:11:06-06:56:37 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-06:56:37 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,25081670,28790456"
    2013:11:06-06:57:30 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-06:57:30 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,25648362,26491712"
    2013:11:06-06:58:23 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-06:58:23 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25081670,28790456"
    2013:11:06-06:59:16 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-06:59:16 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,25648362"
    2013:11:06-07:00:09 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:00:09 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25648362,26491712"
    2013:11:06-07:01:02 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:01:02 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,25081670"
    2013:11:06-07:01:55 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:01:55 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,25081670,25648362"
    2013:11:06-07:02:48 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:02:48 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,25648362,26491572,26491712"
    2013:11:06-07:02:49 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:02:49 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337"
    2013:11:06-07:03:42 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:03:42 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25081670,25648362,26491712,28790456"
    2013:11:06-07:04:35 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:04:35 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,28790456"
    2013:11:06-07:05:28 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:05:28 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,25081670,25648362,26491712"
    2013:11:06-07:06:21 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:06:21 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,9239065,25081670,28790456"
    2013:11:06-07:07:14 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:07:14 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,25648362,26491712"
    2013:11:06-07:07:15 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:07:15 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="28790456"
    2013:11:06-07:08:08 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:08:08 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25081670"
    2013:11:06-07:09:01 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:09:01 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,9239065,25648362,26491572,26491712,28790456"
    2013:11:06-07:09:54 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:09:54 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25081670"
    2013:11:06-07:10:47 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:10:47 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,26491572,26491712,28790456"
    2013:11:06-07:11:40 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:11:40 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,9239065,25648362"
    2013:11:06-07:12:33 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:12:33 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25081670,26491572,26491712,28790456"
    2013:11:06-07:13:26 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:13:26 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25648362,28790456"
    2013:11:06-07:14:19 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:14:19 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,25081670,26491572"
    2013:11:06-07:15:12 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:15:12 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,26491712,28790456"
    2013:11:06-07:16:05 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:16:05 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25081670,26491572,28790456"
    2013:11:06-07:16:58 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:16:58 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,25081670,25648362"
    2013:11:06-07:17:51 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:17:51 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,26491572,26491712,28790456"
    2013:11:06-07:18:44 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:18:44 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,25081670,25648362,26491572,28790456"
    2013:11:06-07:19:37 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:19:37 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,9239065,26491712"
    2013:11:06-07:20:30 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:20:30 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25081670,25648362,26491572,26491712"
    2013:11:06-07:21:23 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:21:23 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,26491712,28790456,32997911,32997912"
    2013:11:06-07:22:16 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:22:16 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25648362,26491712"
    2013:11:06-07:22:17 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:22:17 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="26491572"
    2013:11:06-07:23:10 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:23:10 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="25081670,25648362,28790456"
    2013:11:06-07:24:03 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:24:03 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,25081670,26491572,26491712,28790456"
    2013:11:06-07:24:56 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:24:56 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,25648362"
    2013:11:06-07:25:49 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:25:49 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,25081670,26491712"
    2013:11:06-07:26:42 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:26:42 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,26491572,26491712,28790456"
    2013:11:06-07:27:35 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:27:35 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,25081670,25648362,26491572,32999554,32999555,32999648,32999651"
    2013:11:06-07:28:28 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:28:28 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,9239065,25081670,25648362,26491712,28790456"
    2013:11:06-07:29:21 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:29:21 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="26491572,28790456"
    2013:11:06-07:30:14 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:30:14 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="26491572"
    2013:11:06-07:31:07 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:31:07 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="292337,9239065,25081670,25648362,26491712,28790456"
    2013:11:06-07:32:00 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:32:00 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="28790456"
    2013:11:06-07:32:53 edge epsecd[6440]: I id="4211" severity="info" sys="System" sub="epsecd" name="Received report(s) from Sophos LiveConnect"
    2013:11:06-07:32:53 edge epsecd[6440]: I id="4212" severity="info" sys="System" sub="epsecd" name="Acknowledging report(s)" reports="9239065,25081670,26491712,33001223,33001227"
  • 0
    Just to close this thread.

    If you want to use Endpoint Web Control, you must also be using the Web Protection proxy on the UTM itself.  This is where you configure the policies that are used in Endpoint Web Control.

    There is nothing that prevents you from turning on Endpoint Web Control without the Web Protection, but it will not work.  It was done like this to allow admins to temporarily turn off and on features.
Unfiltered HTML