Sophos All models error codes
Codes
- NEP-6358Error codeOn Sophos Central Windows Endpoints/Servers with HitmanPro.Alert HitmanPro.Alert 3.9.0.1391 (and above), WinDbg Time Travel Debugging (TTD) and TTTracer.exe fail to attach to a process with the following error: Communication between the guest process and this client could not be established, which may be an indication of permissions or privileges problems (see 'c:\temp\traceroutput\.out' for more details)
- NR-1295Error codeTwo Central admins cannot manage the same firewall at the same time Sophos Central Firewall Manager will only store one session token per firewall. If two users try to access the same firewall at the same time the last user to login will have the valid session token. The first user will be disconnected and when navigating the page will see the error “Unable to load page. Check your network connection” This is expected behavior
- NR-1893Error codeVirtual Azure firewalls with a PayAsYouGo subscription may not correctly display the Xstream license on the Central Firewall Reporting (CFR) license page. The licensing page may show only a basic license, even when a CFR Advanced license is active. As a result, selecting the affected firewalls for reporting may trigger the error "multi devices reporting need CFR advanced license", and report downloads may be unavailable if the CFR Advanced license is not in use
- NR-6220Error codeSteps to recreate: Create WAF rule on base Firewall A from which you would want to import the configuration Create a group(Group 1) in Central with using config import option "Import existing configuration" Import the configuration from Firewall A Import would get successful and full sync would also pass if we add any other Firewall device(Firewall B) to this group Get onto "Manage Policy" page of that created Group 1. You will see "Loading" error on Firewall rules page Expected Output: "Loading" error should not show on Firewall rules page on Group, after importing WAF rule Actual Output: "Loading" error is there on Firewall rules page on Group, after importing WAF rule
- NSW-2178Error codeVLANs created in the switch local UI are not synched with Central. Central to switch config sync is allowed, but the reverse sync is not available currently. User common observation: I have three VLANs in my switch, but Central does not show them correctly
- NSW-2179Error code[ Intermittent issue ] When moving an uplink cable from one port to another, sometimes it might take more time for the uplink tick to come, even in the local UI. Under these circumstances, the port status event is sent, but the uplink status moves to 0; after a few seconds, the uplink status changes in the local UI, but, at that time, no events are sent to the Central UI. The faulty status won’t change until the user will update something or a port refresh event will trigger the uplink state refresh on Central UI
- NZT-1002Error codeIn some environments running ZTNA Gateway v2.2, large Active Directory (AD) packets are intermittently dropped at the gateway, causing random failures when accessing AD-based services (e.g. RDP, Windows file shares) for many users.Users may lose AD connectivity or experience slow/failed access to AD-backed applications, especially when traffic involves larger packets (e.g. Kerberos, file access, image-heavy workloads)
- NZT-1969Error codeUsers are facing a 403 error after updating a user group name in Azure AD and accessing an application with the updated group name
- NZT-8467Error codeWhen accessing the ‘Netwrix Password Secure Client’ (a Windows-based client-server application) through Sophos ZTNA, users might experience: Increased CPU consumption (30-60% utilization) Frequent connection interruptions and errors Degraded application performance
- NZT-8925Error codeStream-sensitive applications may experience performance issues when accessed through ZTNA via the Sophos Cloud mode with the current setup
- NZT-9257Error codeOn machines with Single Sign-On (SSO) login enabled, users may experience automatic authentication to ZTNA using their Windows login identity. In these specific environments, when attempting to access ZTNA resources, the system automatically uses the current Windows credentials without prompting for alternative login information. For example, if a user is logged into Windows as "ABC" but wants to access ZTNA applications as "XYZ," the system may automatically authenticate as "ABC" without providing an opportunity to enter different credentials. This behavior only occurs on machines with SSO login enabled and is not present in all scenarios. When SSO login is enabled, the signed-in Windows user is automatically logged into ZTNA and can access resources accordingly. In this specific configuration, there is no way for a user to sign into ZTNA using an alternate account
- NZT-9636Error codeAfter upgrading the ZTNA VMware and Hyper-V gateways (on-premises or Sophos Cloud) to version 2.2 GA, users with on-premises AD acting as identity providers may encounter continuous redirect loops when trying to access the gateway. The loop eventually stops with a "header size too big" error, preventing successful authentication.Sophos is working on a permanent fix for this issue
- NZT-9906Error codeAttempting to delete a ZTNA gateway that has associated agentless applications (SSH, RDP, or web) may fail with a "private access rule ID not found" error. This occurs when trying to delete the gateway directly in Sophos Central without first removing the configured agentless applications running behind the thin connector. The issue is particularly common when browser enforcement is enabled for ZTNA agentless web applications
- PCG-1413Error codeIt is expected behavior for Flex licensed customer accounts are not able to remove the Cloud Optix license To remove any usage so the customer is no longer billed, remove the environments in use (each environment section has a ‘remove’ set of instructions) https://doc.sophos.com/pcg/optix/help/en-us/AboutOptix/index.html It is unexpected behavior seen when attempting to re-run the Partner Dashboard License wizard and check off the Optix component, you will get a generic ‘Update Failed’ pop-up error. This will be addressed in a future version of the Partner Dashboard (and remove the UI option to unselect it, as it is not possible)
- PCG-1616Error codeThere is a known issue where updating Container Registry credentials may result in an "Incorrect credentials" error message. This problem has been identified as originating from the third-party service we use for Container Image Scanning
- PCG-1635Error codeWhen using the Search query feature (Discover > Search), the total amount specific to ‘Activity Logs’ displayed will show a higher total compared when viewing the ‘All activity logs’ total within the Activity Insights section (Activity Insights > Logs > Activity Logs > All tab). This discrepancy occurs because the tabs within Activity logs (Network, Storage, Host, Users) do not include items from the Error logs tab. For example: If Discover Search shows 100 Activity Insight entries. This may show 90 total in Activity Insights > Logs > Activity Logs> All tab. In this scenario, the remaining 10 logs are under the Error tab
- PCG-1660Error codeWhen deploying Cloud Optix in Azure, customers may encounter errors related to regional quota restrictions for Function Apps. These errors prevent the creation of resources in specific Azure regions. Error messages customers may see include: "Unable to create Function resource due to your quota limit in the Azure region (). Select a different region or contact Azure support to request an increase to the app service quota for the region ()." "This region has quota of 0 instances for your subscription. Try selecting a different region or SKU."Reason for the Issue:Microsoft has implemented restrictions on the number of Function Apps allowed in certain regions, regardless of subscription type. This limitation is particularly strict for Azure Pay-as-you-go subscriptions using the App Service Consumption plan. Currently, Microsoft has not provided an ETA for lifting this restriction
- SRV-1380Error codeIn rare cases, binding Sophos Mobile with a third-party service such as Microsoft Intune Mobile Threat Defense fails with a 401 Unauthorized HTTP error. We've only seen this with Google Chrome, not with other internet browsers. Apparently, Google Chrome sometimes doesn't attach a required authorization token to the request
- SRV-1389Error codeWhen a “Send message” task is included in the enrollment task bundle, it might fail with an error message indicating that APNS or FCM information is missing.This can be caused if the device requires too long to send the required information to the Sophos Mobile backend
- SRV-1543Error codeWhen connecting Sophos Central Mobile with a TeamViewer account, the warning message “Can't get authorization from TeamViewer (TeamViewer error (internal_error)). Try again later.” is shown. The binding procedure itself is successful. Requesting remote assistance for a mobile device using the TeamViewer integration works as it should
- TML-1186Error codeWhen the HTML5 VPN portal is accessed via a HTTP proxy that intercepts SSLconnections, the HTML5 VPN portal doesn't work. The user gets a popup errormessage "Websocket Error"
- TML-1193Error codeEnabling a sub-category of 'Facebook' without enabling 'Facebook' itself will not work and will allow access to the sub-categories, although these are checked. Workaround: sub-categories of 'Facebook' can only be blocked when 'Facebook' is enabled itself
- TML-1197Error codeIf configured AD SSO against a ReadOnly DC on a UTM, SSO will fail. While the client tries to authenticate with kerberos you will get following errormessages in the http logfile: "gss_accept_sec_context: Decrypt integrity check failed"
- TML-1202Error codeSophos UTM does not currently support the Websocket protocol when in transparent mode
- TML-1204Error codeWe don't have protocol support for Microsoft's RDG-RPC protocol suite which they added with Windows Server 2012 (we only support the "old" MSRPC suite). Whenever such a RDG (2012) connection fails the log contains line statingmethod="RDG_IN_DATA"ormethod="RDG_OUT_DATA"it's a strong indication the lack of protocol support is causing the connection to fail. Currently, this cannot be mitigated using the WAF
- TML-1206Error codeSometimes during the upgrade from 9.2x to 9.3 it can happen on HA/cluster system that the slave node is going in RESERVED mode (although this feature isn't enabled in webadmin). Output from "hs" on command line looks like this: Current mode: HA MASTER with id 1 in state ACTIVE- Nodes ----------------------------------------------------------------------- MASTER: 1 Node1 198.19.250.1 9.210020 ACTIVE since Mon Dec 15 12:16:22 2014SLAVE: 2 Node2 198.19.250.2 9.304009 RESERVED since Mon Dec 15 13:36:03 2014- Load
- TML-1207Error codeThe official Microsoft Android and iOS remote desktop (RDP) apps don't work with WAF. The apps fail with the following error message when trying to connect to a remote computer through WAF: We couldn't connect to the gateway because of an error. If this keeps happening, ask your admin or tech support for help. Error code: 0x3000008
- TML-1208Error codeIf a recipient validation callout fails (eg. resulting in error: "552 Requested mail action aborted: exceeded storage allocation") Exim only reports back "550 address unknown".This is a design limitation of Exim
- UTM-1000Error codeProblemCertain Sophos SG/XG appliances may become inaccessible except via serial console. In some cases a decrease in performance could be experienced (high disk usage/high load). SymptomThe serial console output shows the errors: Reboot and Select proper Boot device Insert Boot Media in selected Boot device and press a key I/O error on SDA SQUASHFS error The following appliances are affected by this issue. The issue is SSD firmware related so the UTM software does not change the issue. Sophos XG Firewall, UTM, AP, RED: How to find the revision number ResolutionIf you have an SG or XG appliance that is experiencing issues like those shown above, please contact Sophos Support for further instructions. If possible go ahead and make a backup with one of the below KBA's: Sophos XG Firewall: How to backup and restore a configuration Sophos UTM: How to create and restore a backup
- UTM-1032Error codeTime is appearing wrong in logs. Issue is observed when admin changes the timezone on UTM Web GUI. This issue is caused by each running process is spawned off with the current TimeZone (TZ) and this TZ is used for setting the time in the log message. Changing the TZ on UTM Web GUI does not force this TZ change in all current processes in the system. Hence all the logging from current running system will have old time
- UTM-1128Error codeUTM on AWS the Queen interface syncs Alias IP to Workers . Currently, adding or deleting Alias IP objects on Queen would reflect on the Workers as Queen as the controller node, Updates on Alias IP objects would not be reflected on Workers due to the filter mechanism designed . Workaround : If the customer wants to use alias ips on their worker nodes, they can do the following for each alias ip: 1. Create alias ip object and select which interface it's aliasing to. 2. After the alias ip has appeared on each Worker's node, change its attributes through Worker's UI. 3. Verify that the changes to alias ip should stay at Worker all the time until the Queen decides to delete it. Also, use Queen to toggle on/off the alias ip's status
- UTM-1131Error codeUTM will allow multiple host objects to have the same IP address. This means multiple MAC addresses can be assigned to the same IP and there will be no error or warning message that his has been done. The DHCP service will only give the IP out to the first machine to grab the IP address. All other machines will get an APIPA address (169.254.0.0/16)
- UTM-1332Error codeThe number of VLANs supported per interface is dictated by the Ethernet Controller used by the NIC. 82599ES based ethernet controllers support up to 64 VLANs.XL710 based ethernet controllers support up to 256 VLANs, but share forwarding/routing tables with other features and this number is smaller in practice. It ranges between 100 and 180 depending on features in use. The aforementioned Ethernet Controllers are used by the following NICs: Other modules may support more or less VLANs. An indication that the threshold is being crossed is the existence of the following log in dmesg (or kernel.log on UTM): i40e 0000:04:00.0: Error I40E_AQ_RC_ENOSPC, forcing overflow promiscuous on PF If the log above is being seen, lower the amount of VLANs per interface and spread them across multiple interfaces until the logs are no longer generated - this should improve performance
- UTM-1516Error codeWhen the External Proxy feature is configured with the service object "ANY", it causes failures in DNAT and Full NAT rule processing: New DNAT and Full NAT rules cannot be created or updated Existing rules continue functioning until the system reboot After reboot, all DNAT and Full NAT rules disappear from the system The issue stems from an invalid configuration value that passes the system's validation checks despite being incorrect. Specifically, using the "ANY" service object with External Proxy creates this condition
- UTM-4452Error codeEndpoints cannot connect to the MCS server if https scanning is enabled for the decrypt and scan . The http log would give an error like this one 2016:05:18-10:52:11 utm httpproxy[5630]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="" srcip="192.168.1.241" dstip="54.148.0.26" user="admin" ad_domain="" statuscode="502" cached="0" profile="REF_vTSCHPtQsV (LAN)" filteraction="REF_qVYuykYAYD (administrator filter)" size="3742" request="0x18426800" url="https://54.148.0.26/" referer="" error="Failed to verify server certificate" authtime="6" dnstime="1" cattime="0" avscantime="0" fullreqtime="860528" device="0" auth="4" ua="" exceptions=""
- UTM-5593Error codeThe Web Protection policy tester displays an incorrect result in the following case: A domain such as www.youtube.com is blocked A page on that domain such as https://www.youtube.com/watch?v=1234567 is allowed The policy tester will show the URL is allowed, but if a client actually tries to browse directly to it, they will be blocked. The client is blocked because when browsing to that URL, the browser first tries to open up a SSL CONNECT tunnel to www.youtube.com, which is blocked. The client doesn't actually get the chance to request the actual URL. This occurs regardless of whether Decrypt & Scan is enabled
- UTM-6318Error codeIf an administrator creates a whitelist/blacklist object within a Web Filter action, but then doesn't save the filter action (eg. clicks Cancel), another whitelist/blacklist object with the same name cannot be created in any other filter action. When attempting to create one, an error appears: "The whitelist/blacklist object with the same name '(name)' already exists
- UTM-6650Error codeWebserver protection is only warning on SQL injection instead of blocking. reverseproxy logs will show ModSecurity: Warning message and does not block the connection This was caused because the following where added to the skip filer rules list 981203, 981176, 981204 These rules are need to decide if the SQL inject should be blocked, because they are not done the SQL inject is not blocked
- UTM-8000Error codeOn UTM quarantine directories are sycned across all nodes. Any e-mail quarantined on a node is synced to the node directory across all nodes - this is valid also for "RESERVED" nodes. Directory structure:spool/quarantine// Spool directory:/var/chroot-smtp/spool E-mails on HA systems are by design not automatically syned if there is a failover. To retrieve e-mails of a failed node the administrator has to copy the e-mails manually. Copy e-mails from the failed to the current node (ID):spool/quarantine// to spool/quarantine/ After this restart the SMTP:/var/mdw/scripts/smtp restart
- UTM-8001Error codeThe logs show the following error message 2017:03:03-18:59:57 example-utm exim-in[8500]: 2017-03-03 18:59:57 1cjx77-0002D6-0E spam acl condition: cannot parse spamd output This issue is being cause because the spam lookup module is failing to connect to the lookup servers
- UTM-8805Error codeIt is not possible to add two or more static routes for the same destination network (even with different metric and gateways).Error Message: The network 'xxx.xxx.xxx.xxx' is already in use by the destination network attribute of the static route object 'xxxxxx'For failover purpose please follow the KBA
- UTM-9276Error codeIs it expected behaviour that the retry time includes the time a mail was in quarantine If a mail was moved to quarantine and was released later the mail server rejects the mail with a temp error 421.Instead of a retry the UTM logs "retry timeout exceeded" and sends a bounce message to the sender
- UTM-9452Error codeProblem: This issue can happen when PMTU discovery does not work as expected on HA link. There is no side effect other than the occasional error message from Pluto. Solution: Ensure there is no PMTU black hole in HA link path
- UTM-9722Error codeAffected models:-SG430, SG450, XG430 and XG450 using 8x1G Copper Module in Slot A with 4x10G Fiber Module in Slot C combination. Issue condition:-Error can be seen only during reboot/power cycle (more than 4-5 reboot/power cycle). None of the Ethernet Interfaces could be visible in ifconfig Error Message:- PCI Vendor and Device IDs do not match! Technical Root Cause:- 8x1 Coppler Module PCI-E root from CPU has detected and configured LAN chip of i350AM4 but failed to be configured with upstream/downstream PCI-E port. Issues will happen only using 8x1G copper module in Slot A with 4x10G Fiber module in Slot C:-1. 8x1G copper module doesn’t detected during multiple reboot.2. Appliance doesn’t boot after post with error ”PCI Vendor ID and Device ID doesn’t match”3. Appliance stuck after post, no boot at all.Note: Issue can be seen only in case of mutiple reboot/power cycle (more than 4-5 reboot/power cycle). Temporary Solution:- Just reboot the device will detect the interface again and working normal. Permanent Solution:- SG afftected models must be upgraded to latest official BIOS version. Affected Bios Version SG 430 - R1.04 (11092015) or any lower version SG 450 - R1.03 (11092015)
- XDR-8079Error codeThe Integration Credential Manager status for Microsoft 365 - Response Actions is currently displaying as ‘Unknown' with a question mark (or 'Awaiting Usage’ with a line). The 'Last Accessed' date and time for Microsoft 365 - Response Actions will not be populated. Sophos Engineering is also aware that this behavior will trigger Credential Manager to send an Alert after 90 days from when the integrations were configured, which states the credential will be suspended in 89 days. Both of these behaviors are expected, though additional work is being done to allow customers to manage the ‘suspension' alerts better. Currently there is no method to edit or manage Suspension alerts, and this is expected to change in October timeframe: Further details can be seen in this Community post
- XDR-8491Error codeSome browser extensions can interfere when onboarding a new XDR/MDR integration within Central Dashboard. This could result in the integration not successfully completing, and the following behaviors have been seen: Triggering a red pop up error “Something went wrong in the credential provision” in the bottom right of Central. either when first entering the integration name, or after completing the Microsoft Authentication No UI error is seen. It initially seems the integration onboarding was successful (the Microsoft Authentication window/onboarding was successful, and the Credential Manager entry exists) but there is no Integration showing on the integration page. This can be seen with any integration that utilizes the Credential Manager as part of its workflow, but it is mostly seen with the O365 Response Action integration. Workaround: To check/confirm if this is the issue, separately log into Central with an incognito/inprivate browser window (with no extensions loaded) and re-try the integration onboarding. It is ok to delete any previously created Credential Manager entries. If this does not resolve the issue, please: Delete any previous entries created in the Central Creden
- XDR-9781Error codeSome Microsoft Entra ID (Azure AD) security configurations can interfere when onboarding a new Microsoft Response Action (Graph Security API v2) integration within the Central Dashboard. This may result in the integration not completing, with the following behaviours observed: The onboarding flow completes Microsoft authentication successfully, but the integration is not created in Central A generic error may be shown during or after provisioning (for example, “Something went wrong” or credential provisioning failure) No clear UI error is presented, and it appears onboarding was successful (Credential Manager entry may exist), but the integration is missing Provisioning silently fails during backend operations such as: Application credential (secret) creation Permission grant or admin consent Service principal configuration This can be seen with integrations that require Microsoft Graph Security API permissions and automated provisioning, particularly the Microsoft Response Action integration. Workaround: To check/confirm if this is the issue, validate whether restrictive Entra ID policies are configured within the tenant. These policies may block application behaviour required for