April 21, 2021
Sophos XG Firewall

Sophos XG “hangs” on packet capture

When using packet capture in Sophos XG the graphical user interface hangs sooner or later. Besides the normal firewall log that comes in handy when finding packets that are either being allowed or blocked, Sophos XG also has a very good packet capture tool inside the GUI. With this tool you can granularly dive into each individual packet if needed to see what is really going on.

There is however one flaw that still exists in version 18.0.4 MR-4 of the XG firewall. To my experience it is almost a guarantee that the Sophos XG GUI will completely hang at some point.

The spinning icon in the GUI doesn't go away and the GUI "hangs".
The spinning icon that doesn’t go away indicates that Sophos XG hangs

Luckily it’s just the GUI and traffic will continue normally, however you can’t do anything anymore in the GUI.

Pulling the plug and restarting the firewall is one solution that solves this issue, but it will inevitably disrupt your connections. The quickest way to restore when Sophos XG hangs is by restarting the Tomcat service.

Restarting the Tomcat service when Sophos XG GUI hangs

You can restart any service from a remote shell. To be able to use it you must have set up a remote shell before from the GUI.
Once you have set it up, connect your SSH-client (PuTTY is a good Windows client) and connect to the XG-firewall. After logging in choose option 5 (Device Management) followed by option 3 (Advanced Shell) then type in the following command:

service tomcat:restart -ds nosync

If everything works out, you will get a ‘200 OK’ message indicating that the service has restarted. You can then almost immediately connect back to the GUI (but you will have to logon again).

Restart Tomcat service when Sophos XG hangs and the 200 OK message for succes

If that is not possible because you didn’t set up SSH-access beforehand, than you can also just wait. Usually after a couple of minutes the situation will restore itself.

If you find this post interesting, you may also like my other posts about Sophos XG.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.