Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 11 replies
  • Answers 1 answer
  • Subscribers 6 subscribers
  • Views 35214 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Endpoint Protection Socket failed on UTM9

carpediempower
Dear all,

Since a few days ago I have a problem with activating the Endpoint Protection in the UTM9 web interface. The problems started with my protected machines being "not compliant". Because I believed that the system was wrong (or confused), I decided to disable the Endpoint Protection from the web interface. Upon trying to re-enable and activate the Endpoint Protection, it failed. See attached screenshots for the errors.

I have tried lots of things in the meanwhile, all of which I found here on the forum. 
- I have added rules in the Transparent proxy skip list (I've added Sophos LiveConnect to both src/dst).
- I have build additional regex strings to add in the exception list.
- I disabled web protection and advanced threat protection. Didn't help.
- Rebooted the firewall

I was unable to determine the root problem, there are no log entries which I can relate to the firewall. This I find very strange, it appears the firewall does not log the errors?

I also tried to take a tcpdump of the problem. I was able to isolate two IP addresses which I can relate to the activation process (54.251.33.46 and 54.72.45.94). I have added the logs of the tcpdump.

Does anyone have any suggestion what I can do?

Thanks for reading, any help is appreciated!
Grts!

Edit:
I'm on firmware release 9.310011


This thread was automatically locked due to age.
  • 0
    If you have Country Blocking enabled, try turning it off.  I've found in many cases the IPs used by Sophos Cloud are located overseas, and some countries are blocked by default in many of my customer's UTMs.

    If that doesn't work, and you have a commercial license (paid), start a support case with Sophos.
  • 0 in reply to BrucekConvergent
    I am having trouble enabling endpoint protection too : 

    Socket failed, unable to get ip for sss1-db08.broker.sophos.com. Error: .

    I also disabled country blocking but no improvement. But it looks like it is more DNS related. However, all other functionality works ?

    Anybody a clue ?

    regards, 

    Sebas
  • 0
    Hi, Sebas, and welcome to the User BB!

    Socket failed, unable to get ip for sss1-db08.broker.sophos.com. Error:

    Where are you seeing that?

    Cheers - Bob
  • 0 in reply to BAlfson
    Hi, 

    When enabling endpoint protection and having pressed activate.

  • 0 in reply to sebaz
    Hi, 

    When enabling endpoint protection and having pressed activate.



    I have excatly same problem, as above. Any solution to fix it?
  • 0
    Same error here with a newly installed UTM 9

    unable to get ip for sss1-0816.broker.sophos.com
  • 0 in reply to ChristianBock
    Activation is trying to go to broker.sophos.com on my internal interface (eth0), which is not connected to the internet.
    After i have switched the eth0 to a network with access to the internet, the activation was successful.
    Is there an option to tell UTM to use the WAN interface (eth1)?
  • 0

    Doing this seems to have worked for me when I was having this issue:

    Management -> System settings -> Reset configuration or passwords -> Reset UTM ID now

    It will reset your Endpoint Protection but it probably wasn't working in the first place.

  • 0 in reply to JasonHerrlich

    Same issue here.

    Did a disk swap after my original hardware died, put it into same model hardware, worked fine, had to tweak network interface names as it named the interfaces differently.

    Tried resetting the UTM ID as per JasonHerrlich's post without success.

    Any way to set the interface for the Endpoint Protection per the commandline tool?

  • 0 in reply to Sharlie

    Hi, Auke, and welcome to the UTM Community!

    I'm not sure what your question is, but I would approach this differently:

    1. Get a configuration backup from before you made the changes to interface assignments and put it into the root directory of a USB memory stick.
    2. At the console as root, edit /etc/udev/rules.d/70-persistent-net.rules to change the NIC order.  Save the file.
    3. Insert the USB stick into the UTM and reboot it.

    Any better luck with that?

    Cheers - Bob