Sophos All models error codes
Codes
- LAT-5937Error codeThere is a known behavior where previously uploaded custom logos' may display larger than needed after exporting a Custom Dashboard report. The logo in the top right of the PDF report will block some of the data. This is due to the original upload size being larger than the currently allowed logo size. Exporting Dashboards - https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/Dashboards/ManageDashboard/index.html#export-dashboards-to-pdf Co-branding - https://docs.sophos.com/central/customer/help/en-us/ManageYourAccount/AccountDetails/index.html#co-branding The logo will need to be re-uploaded to the current specification/requirements (that are smaller than what they were originally) Image width: Between 50px and 80px Image height: Between 40px and 70px (48px recommended) Acceptable formats:.JPEG,.PNG,.GIF,.JPG Max file size: 100K
- LAT-5998Error codeWithin the Partner and Enterprise Dashboards > Alerts section. It is currently expected behavior that any UI filter options selected will not be included in the ‘export to csv’ output
- LAT-6127Error codeIt is expected behavior for the Partner Dashboard > Customers page when viewing the licensing information for a customer, which will display the license twice when the customer has an active in-product trial in addition to their current license. Once the in-product trial expires, the license information pop-up will only show the remaining license
- LAT-6265Error codeIt is currently not possible to add a new Entra ID Directory Service if it uses the top level domain of .inc In the interim of the issue being resolved, the users and or mailboxes can be added manually into Central Dashboard
- LAT-6360Error codeThere are several different error messages/types that can be seen within the Sophos Automate plug in Logs section. 500 - Server failure (Sophos) Expected - This can be seen as a transient failure response (Sophos side failure). They are not seen repeatedly against the same customer. These will be seen less frequently than 504 entries. Unexpected - if the error is repeated with every sync (every 20 minutes) and never resolves, if its seen against one particular customer and never resolves, or if it results in you not being able to do something in the UI (eg. you do 'X' but only response back is errors logged) 504 - Gateway timeout (Sophos) Expected - This can be seen as a transient failure response (Sophos side failure). They are not seen repeatedly against the same customer. These can be seen more frequently than 500 entries. Unexpected - if the error is repeated with every sync (every 20 minutes) and never resolves, if its seen against one particular customer and never resolves, or if it results in you not being able to do something in the UI (eg. you do 'X' but only response back is errors logged) 403 - Not authorized (Sophos) Expected - This can be seen when either Automate/Kase
- LAT-6387Error codeThere is a known issue when trying to map/add a new Autotask usage service , following the directions - https://docs.sophos.com/central/Partner/help/en-us/AutotaskIntegration/AutotaskProductMapping/index.html#map_to_new_service If the name you give the ‘Autotask service name’ has an ampersand included (&) it will fail to be added after selecting the ‘Apply’ button. Error seen in the UI is a generic “Something went wrong. Please try again later” Error in the browser developer tools for the network call is a 500 error Post
- LAT-6447Error codeSophos engineering is aware of a UI/text issue on the Partner Dashboard > Managed Customers Usage page https://cloud.sophos.com/manage/partner/managed-usage-list/all Currently it includes excess text ‘™’ in the sub headline
- LAT-6620Error codeA partner may see the following message when using the ‘Change License’ workflow for a Flex/msp tenant. Message shown after selecting a tenant to change licenses: “Unable to load current licenses” Feature in question - https://docs.sophos.com/central/partner/help/en-us/Help/MyBusiness/Mycustomers/ManagedCustomerUsage/ChangeLicenses/index.html This indicates that the license data for the tenant is not visible to this workflow. This can be resolved by: launch into the Tenant in question from your Partner Dashboard Click the Profile icon in the top right, and then click Licensing On the Licensing page, select the refresh icon that is next to the 'Last updated:' date on the top left. After the sync has completed (a green toast message appears that says ‘licenses sync’d'), go back to the Partner Dashboard and reselect the tenant and the Change license option. The tenants' licenses should now be manageable
- LAT-6664Error codeThe following Partner (PDB) and Enterprise (EDB) Dashboard messages below may be experienced if any of your central managed tenants data is configured in the UAE AWS region. Due to the incident covered in KBA-000047004 the following behavior can be seen: Main PDB/EDB dashboard > Alert Total widget “Alerts info is unavailable. Try again later.” This is seen because the aggregated api call for all customer/subestate alert totals will fail if it cannot access all regions your tenants reside in, such as the UAE region currently. PDB/EDB > Alerts page: “We cant reach all customer data regions so the data here isnt complete. Any action by you will only take effect on the data that is currently available” This is seen for the same reason as #1. Due to the api call not being able to access the UAE region successfully, it will only show alerts from all of the regions it can access
- LAT-6727Error codeSophos is aware of a scenario where some customers scheduled to be unlinked from a Partners Dashboard does not complete after the first of the month. Additionally, if you try to delete the unlink request, it will show an error “partner.customers.delete.scheduled.unlink.not.processable” Sometimes the bulk unlink can fail for one or more requests at the first of the month. These customer unlink requests are expected to be redone and completed by the 6th of the month. If the customer has not been unlinked after that date, please raise a technical support case up, referencing the customer name and uuid, along with this Known Issue ID CPLAT-67279
- NC-1140Error codeOnce we tick select “All” option , tick mark will be disappeared and all individual modules / components will be enabled. Current behaviour of “All” button is since inception as short cut to select all the relevant component. The result of actions is transferred to individual buttons and stored in backend as separate status for each component. As it is only UI action button and not the summary of status all button - it is expected behaviour
- NC-1158Error codeThe NAT information for Source NAT gets updated for existing connection (re-route) when the failover occurs on IPsec tunnel. Currently for re-route of existing connection Source NAT information isn’t updated as NAT occurs only when new connection is initiated. ( Known behaviour ) NAT id and Source NAT information doesn’t change when re-route occurs. For ICMP traffic, the ongoing traffic should be terminated first then wait for 30 seconds to delete/destroy the ICMP conntrack. New ICMP traffic will be forwarded via updated NAT ID.NAT ID will not be changed for on-going connection during the re-routing
- NC-1206Error codeDescription SSLVPN User still shows in the live user list after disconnection from the client when connecting using UDP Configs on SFOS: SSLVPN Global settings are configured with Protocol as UDP Create a user, and add it under the SSL VPN profile Download the SSLVPN configuration from the user portal and use it on remote access client Initiate the connection and the connection will be successful. Disconnect the tunnel from the remote access client The client will disconnect from the connect client application but it will still appear under the Current activities → Live user list
- NC-1313Error codeIn some scenarios, the user cannot register the auxiliary firewall in Sophos Central -Webadmin gives the error “ Couldn’t Register the firewall with Sophos Central. Verify your Sophos Central Credentials.” due to a mismatch of MTU on the outgoing interface and HA dedicated interface
- NC-1366Error codeWhen importing a configuration that has the BridgeToEthernet (simplified bridge) setting enabled for localwifi, the import process does not correctly retain this setting. After import, the Local WiFi Bridge (Lw_Br/Lw_Br0) will be displayed on the network page, but the BridgeToEthernet option in the localwifi configuration will be displayed as Disabled. Before exporting the configuration, it is recommended to disable the BridgeToEthernet setting for localwifi to ensure a consistent import process. Currently, no workaround is available for this issue
- NC-1514Error codeSophos Firewall virtual devices deployed before version 18 (devices with a 600MB /conf partition) can't be upgraded to version 21.5 and later. When upgrading, the user gets a generic firmware upgrade failure message. In those specific conditions, an alert message is shown in the firewall dashboard, forwarding the user to the following KBA for a detailed description and workaround: https://support.sophos.com/support/s/article/KBA-000010091
- NC-1646Error codeOnly displayed result will be included while exporting data into HTML/ PDF / CSV We can download current page records which is displayed on page through HTML/ PDF/CSV. Example : Web report total pages 20. If current page 3 then we can download page 3 records through HTML /PDF /CSV. We can download report which display on current page
- NC-1655Error codeSSL VPN connections using Local authentication may experience re-authentication failures (based on Key lifetime) if static IP leases are configured on the firewall. The connection attempt fails specifically during the IP lease process, preventing successful VPN re-establishment. When a static IP is configured for an SSL VPN user, the access server incorrectly treats the already-leased IP address as a conflict during re-authentication. This forces users to manually re-enter their credentials to establish a new tunnel after the Key lifetime expires (default: 18000 seconds)
- NC-1665Error codeSome customers may experience firewall registration errors when their company name contains certain special characters, like the following Code Name U+200B Zero Width Space (ZWSP) U+200C Zero Width Non-Joiner (ZWNJ) U+200D Zero Width Joiner (ZWJ) U+2028 Line Separator U+2029 Paragraph Separator U+2060 Word Joiner U+FEFF Zero Width No-Break Space (Byte Order Mark)This behavior has been identified and will be addressed in our systems to prevent those characters from being used
- NC-1671Error codeWhen configuring firewall rules for Entra ID SSO users, please note that these users can access internet resources only when their primary group is specified in the firewall rule. Unlike on-premises AD users, who can access resources through both primary and secondary group memberships, Entra ID SSO users currently require primary group specification for proper access control. This behavior does not affect Sophos Connect VPN with Microsoft Entra ID SSO. This issue will be fixed in the next maintenance releases
- NC-1762Error codeXGS devices with WWAN modules may experience cellular link instability when real client traffic is routed over WWAN1, particularly with QUIC/HTTP-3 and heavy HTTP-2 over UDP/443. Symptoms include high packet loss, repeated WWAN gateway up/down events, frequent WWAN reconnects, and modem failures to provide DHCP IP addresses. This results in failover instability, service degradation, and operational noise, especially in environments with marginal 5G signal quality
- NC-1775Error codeAfter upgrading to SFOS v22.0.0 GA, customers may receive "Malware Unscannable" alerts, commonly targeting traffic to www.msftconnecttest.com (Microsoft Network Connectivity Status Indicator). These alerts occur only during the upgrade process and are not reported afterward. While alerts are generated, users may experience websites being blocked for an additional minute beyond normal upgrade times. Legacy Web Proxy users will see block pages, while DPI users will experience broken page loads
- NC-1817Error codeWeb Instant Alert email notifications are not generated when web traffic is denied or blocked by a web policy. The alert feature currently operates only on allowed web traffic. When a web category is set to "Block" and Instant Alert is enabled for that category, no email notification is sent after the blocked access attempt. This affects all users with Instant Alert configured for blocked web categories on SFOS 22.0.0 GA (Build 411). A fix is planned for the SFOS v23 release
- NC-1819Error codeOn appliances running SFOS 22.0.0 GA or later, the IPS service may, under rare circumstances, enter a "Dead" status and fail to restart. This occurs because the required web policy configuration data becomes unavailable, preventing the web policy service from starting. As a result, IPS cannot initialize its policy and exits with a fatal error. IPS pattern updates will also fail while the service is down. In High Availability (HA) deployments, both nodes may be affected independently. Sophos is working on a hot fix to prevent this issue
- NC-1820Error codeAfter upgrading to SFOS 22.0.1 MR-1, administrators may be unable to release or delete quarantine emails when managing the firewall through Sophos Central. The operation fails with an "Invalid API request" error. This issue affects all quarantine email actions (release and delete) performed via Sophos Central and does not occur when accessing the firewall directly through its Webadmin console. A fix will be included in SFOS 22.0.2 MR-2
- NC-2745Error codeWe don't have protocol support for Microsoft's RDG protocol suite which they added with Windows Server 2012 (we only support the "old" MSRPC suite). Whenever such a RDG (2012) connection fails the log contains line statingmethod="RDG_IN_DATA"ormethod="RDG_OUT_DATA"it's a strong indication the lack of protocol support is causing the connection to fail. Currently, this cannot be mitigated using the WAF. WAF only supports RPC_IN_DATA and RPC_OUT_DATA, these are the only types enabled when Pass Outlook Anywhere is turned on. All other methods are unsupported
- NC-5980Error codeWhen utilizing the XG Email protection module in MTA mode, this creates an automatic firewall rule for the SMTP traffic at the top of the policy list. If additional rules are created above this rule, this can result in the XG accepting SMTP traffic but then being unable to deliver the mail onto the next hop. This can be seen by the mail queuing on the appliance and time out errors in the /log/smtpd_main.log: 2369 == [email protected] R=default_mx_router T=remote_smtp defer (110): Connection timed out2020-02-07 10:57:39.081 [2369] xPlIal-cb3y0D-DL == [email protected] R=default_mx_router T=remote_smtp defer (110): Connection timed out This can occur with: Manually configured firewall rules that include the SMTP service Automatically created firewall rules when configuring a VPN tunnel We plan to improve on this behaviour in an upcoming software release
- NC-6029Error codeWhen using the Sophos Network Agent (iOS or Android) logout could take up to 2h. The APP itself gets disconnected immediately but on the UTM the user is still live which actually means he can still access network resources which should be blocked
- NC-6038Error code**This scenario is observed when the DHCP request comes via a bridge interface and Heartbeat is set to block endpoint communication with RED heartbeat status on the firewall rule with inter-zone communication rule i.e. rule configured for Bridge interface. The MAC address is blocked this would also include the DHCP traffic for affected client machines. When packets enter into the bridge interface, we are entering into Netfilter stack from L2 and all the decisions related to packet/connection taken at Layer 2. Now here, what happened is that Packet dropped by Firewall when it enters from the L2 stage. So traffic never submits to L3 (bridge interface) where the DHCP server is listening and DHCP will never get the packet. This issue will only for the client behind the bridge and will not happen for any other interface
- NC-6353Error codeIf the user tries to add any domain or email address on the Page 'Email>> general setting>> block senders', then he'll get the error "Request could not be completed" and the domain or email address would not be added
- NC-6963Error codeA user interface issue exists in SFOS, reported in v17.5MR9 but also exists in later versions. If an Admin adds a wildcard SMTP exception for an FQDN host (Email->Policies and exceptions->Exceptions), the FQDN wildcard entry is accepted and is visible in the UI, Email -> Policies, and exceptions. However, if the Admin attempts to edit this exception the added wildcard entry will not be visible. This is confirmed as a UI issue and we are currently investigating. We have no fixed date or version at this time
- NC-7140Error codeRegistering Sophos Firewall on Sophos Central fails with the error "Temporary error while accessing Sophos Central, please try again" when using an email address longer than 50 characters. While this error can occur for multiple reasons, in this particular case, it's triggered when the registration email address exceeds the 50-character limit.Note: If you have attempted registration more than 5 times within the last hour, the account will be temporarily blocked for up to 5 hours. Please wait and try again after this period
- NC-7317Error codeLogViewer shows twice DDNS events for Success/Failure
- NC-8405Error codeThe backup will not be restored if there is an error with the database tblappstoeps as it may contain invalid byte sequence for encoding "UTF8" Logs will be seen in Postgres.log 772 2022-01-08 03:01:18.064 GMTERROR: invalid byte sequence for encoding "UTF8": 0xb1 6772 2022-01-08 03:01:18.064 GMTCONTEXT: COPY tblappstoeps, line 23612 6772 2022-01-08 03:01:18.064 GMTSTATEMENT: COPY tblappstoeps (app_id, uuid, app_path, occurrence, last_seen) FROM stdin
- NC-8506Error codeThe Web Application Firewall (WAF) enforces a 1 MB size limit on file uploads in Outlook Web Access (OWA). When users attempt to upload larger files, the request is blocked. If a file exceeding this limit is uploaded, the system logs an error message similar to: [Fri Aug 14 15:41:22.414802 2020] [security2:error] [pid 14238:tid 140229323249408] [client 109.91.34.26:44831] [client 109.91.34.26] ModSecurity: Request body no files data length is larger than the configured limit (q).. Deny with code (413) …. Starting with the 21.5 release, the Web Application Firewall supports a configurable request (upload) file size limit and can scan file sizes up to 1 GB
- NC-8907Error codeThe issue is happening when Sophos Firewall is configured Sophos IPsec connect with Local ID. This configuration is not supported by IOS. The IOS profile does not support any parameters with Local ID/Remote ID and which causes a failure to authenticate the connection
- NC-9132Error codeWebSockets is an advanced technology that makes it possible to open an interactive communication session between the user's browser and a server. Sophos XG Firewall only supports WebSocket passthrough starting from version 17.0, in earlier versions this functionality of Webserver Protection is not availableos XG
- NC-9820Error codeWhen using RadiusSSO and roaming between APX’s the client has to reauthenticate in order to connect again. This is a limitation with the current deployment. RadiusSSO currently cannot handle roaming between access points
- NC-9986Error codeIssue: When the blocked senders list get large it can fail to add new entries. The exact number of entries will very as it depends on the length of each email address. We have seen issues when lists get over 2400. Users will see warning message saying The operation will take time to complete. The status can be viewed from the "Log viewer" page Checking csc.log will show a line like this “2021-06-02 11:40:21,411:ERROR:CSC - Exception in getStatusFromResponse() :java.lang.NumberFormatException: For input string: ""java.lang.NumberFormatException: For input string: ""
- NCL-1377Error codeThere are two cases where the IPSec connection downloaded via the provisioning file might not be updated once a change is made on the XG 1) The Sophos Connect Client has an active connection 2) The Sophos Connect client is not connected to XG when the XG policy is modified. When the Sophos Connect client will try to connect to XG, the connection will fail due to a policy mismatch error. The client will not automatically trigger a update policy request. The user has to manually trigger a "Update policy" request from the settings menu. This might happen with a greater probability if the allowed networks are changed in the policy. Also this will happen if a policy is changed from tunnel all to split network and the network list is not identical on both ends
- NCL-1618Error codeThis relates to Sophos Connect Client configuration of the SFOS appliance using 3rd party signed certificate. When using 3rd party signed certificate on the “remote side” of the configuration, and "ApplianceCertificate" on the local side, the connection will import fine and connect the first time. After reboot of the workstation or restart of the services related to Sophos Connect, an error message will pop up stating "Failed to validate server certificate" when trying to connect again
- NCL-2798Error codeOn MacOS, upgrading Sophos Connect from 1.4 MR1 (or older) to 2.0 can show an “OpenVPN service is not available” error message in the Events logs and still display the old 1.4 version in the About section. The installation may appear broken after the upgrade, potentially confusing users about whether the client is installed and working correctly. This happens only on clients where Sophos Endpoint Protection device with Tamper Protection turned on is installed
- NEP-5182Error codeWindows Server 2022 backup jobs are failing with the error:Backup of volume \\?\GLOBALROOT\Device\HarddiskVolume1\ has failed. Windows Backup failed to get an exclusive lock on the EFI system partition (ESP). This may happen if another application is using files on the ESP. Please retry the operation
- NEP-5239Error codeIf a version of the installer prior to 1.6 (released late 2019) is used in 2023 or later, it will result in a damaged install (no MCS communication and other problems). Uninstall, then reinstall with a newer installer
- NEP-5537Error codePlatforms such as Windows 10 32-bit, Windows 7 and Windows 8 may encounter an issue when Web Control is configured to block file types from being downloaded. If the URL/IP address of the site is excluded as a “Website” exclusion, the exclusion will not apply to these platforms and the file download will be blocked
- NEP-5922Error codeCustomers using mapped network drives with the ZTNA Agent will have to authenticate manually to the drives as the connection to the shared drives occurs before the login process is complete. The ZTNA agent is currently designed to establish a secure tunnel with the gateway once the user logs into the device. Network drives are mapped during the login process so are mapped prior to the ZTNA Agent starting
- NEP-6120Error codeSummary Significant latency or complete failure, i.e. degraded browsing performance when attempting to access various websites using Mozilla Firefox Description Users may experience noticeable lag when browsing websites in Mozilla Firefox while Sophos Endpoint's "Real-Time Scanning Internet" and "Web Control" security features are enabled. Workaround Open Mozilla Firefox. In the address bar, type: about:config. Press Enter. If a warning appears saying "Proceed with Caution", click "Accept the Risk and Continue". In the search bar, type: network.dns.use_https_rr_as_altsvc. When the preference appears, click the toggle button on the right so the value becomes false
- NEP-6139Error codeDesktop messages configured in Central policy may be cut off when exceeding the character limit. Example: “Use of application Microsoft Edge has been blocked by your admi”
- NEP-6140Error codeDuring a Sophos Endpoint Defense Service housekeeping routine, which executes every five minutes, virtual machines running on Proxmox Virtual Environment Clusters with AMD CPUs may experience brief periods of unresponsiveness. Our technical team is actively investigating this issue. Please note that Proxmox is not currently listed among our officially supported virtualization platforms. For more information about supported virtualization environments, please refer to our knowledge base article: Sophos Central Endpoint and Server: Support for virtualization platforms https://support.sophos.com/support/s/article/KBA-000002209?language=en_US
- NEP-6163Error codeBlocking Optical in Peripheral Control will also block mounting ISOs. CD-ROM ISOs will alert normally and can be excluded, however DVD ISOs will not alert, which makes it difficult to exclude them. This can also trigger a further error if it has been attempted multiple times