topic Re: Recent Sophos update has broken HIP checks on Global Protect in GlobalProtect Discussions

Recent Sophos update has broken HIP checks on Global Protect

VAsupport — Thu, 21 Apr 2022 10:01:32 GMT

We have an issue that we have logged a PA TAC case but wanted to stick out a forum post to see if others are having this issue.

It seems when the machine upgrades Sophos from 2.20.11 to 2.20.13, we get the following message:

"Your AntiVirus is not updated". HIP checks then fail. The only thing changed is the version of Sophos, but the HIP checks don't care about versions, or arent meant to care about versions.

This issue is happening on multiple portals deployed, all running different versions of PAN-OS. 9.0.3-h3, 9.1.7 and 10.1.3

Re: Recent Sophos update has broken HIP checks on Global Protect

Bill-NS — Thu, 21 Apr 2022 19:15:53 GMT

Can confirm. Same issue first noticed yesterday.

Re: Recent Sophos update has broken HIP checks on Global Protect

SuryaR — Fri, 22 Apr 2022 13:13:29 GMT

Same issue noticed yesterday.

Reinstalling Sophos has fixed the issue for us.

Re: Recent Sophos update has broken HIP checks on Global Protect

Bill-NS — Mon, 25 Apr 2022 17:11:23 GMT

Unfortunately, reinstalling Sophos did not fix it for me.

Re: Recent Sophos update has broken HIP checks on Global Protect

gwattsrb — Thu, 28 Apr 2022 13:23:10 GMT

We've had the same issue running 9.1.12-h3, we've deployed a work around but could really do with a fix. The work around we've implemented is stop checking for virus definitions within a specific period which is less than ideal.

Re: Recent Sophos update has broken HIP checks on Global Protect

SuryaR — Thu, 28 Apr 2022 13:26:39 GMT

Uninstall and Reinstall stopped working.
When sophos is reinstalled it is at version 2.20.11, this version works but due to automatic updates enabled, it upgrades it self to 2.20.13 and this version breaks HIP checks..
Hope there will be a fix soon...

Re: Recent Sophos update has broken HIP checks on Global Protect

Bill-NS — Fri, 29 Apr 2022 13:22:45 GMT

I logged a ticket with Sophos. Their position is that PA would have to make changes.

"Sophos is on Sting 2.0 version which is Core Agent 2.20.13 and SAV is merged into SED

Your vendor's VPN is unable to detect SED, We would recommend to contact their support so, they can make changes from their end to work with new Sophos updates. "
and referred to this page: https://support.sophos.com/support/s/article/KB-000043550?language=en_US

Re: Recent Sophos update has broken HIP checks on Global Protect

trivers01 — Wed, 18 May 2022 16:19:52 GMT

Hey @VAsupport ! We're currently working with both Sophos and OPSWAT's Engineering Teams to resolve this issue. If you're encountering the issue, please feel free to open a Support case for us to track alongside the others and we'll post any updates and/or resolution immediately once they become available!

Re: Recent Sophos update has broken HIP checks on Global Protect

ttec_fw — Thu, 16 Jun 2022 01:48:48 GMT

Is there any resolution to this problem ? I have a remote consultant using Sophos and it is causing delays on the project.

Re: Recent Sophos update has broken HIP checks on Global Protect

SuryaR — Thu, 16 Jun 2022 15:20:52 GMT

On the TAC case we opened Palo confirmed that they got a new SDK from Opsswat which can detect new version of Sophos. TAC thinks that this new version will be included in the next GP version release but have no confirmation yet.

Re: Recent Sophos update has broken HIP checks on Global Protect

trivers01 — Thu, 16 Jun 2022 15:25:54 GMT

@ttec_fw @SuryaR we have already updated the GP App with the new OPSWAT SDK and we're currently prepping it for release. Please contact either TAC or your Account Team on the definite release date, however, we're unable to provide one at this time.

Re: Recent Sophos update has broken HIP checks on Global Protect

PhilipFrancis — Fri, 17 Jun 2022 08:30:59 GMT

Hi bud

We have the same issue.

Can you please supply me with a bug ID ?

Thanks

Re: Recent Sophos update has broken HIP checks on Global Protect

Steph01 — Tue, 23 Aug 2022 10:28:59 GMT

Is Palo going to release official communication about this and its resolution?

Re: Recent Sophos update has broken HIP checks on Global Protect

RobertShawver — Thu, 08 Sep 2022 18:02:45 GMT

Was this ever fixed? I'm having the same issue with a contractor. I've tried 5.x and now 6.x and neither worked.

Re: Recent Sophos update has broken HIP checks on Global Protect

GCBS_IT — Tue, 13 Sep 2022 21:24:30 GMT

Now that nearly 3 months has passed since the last update, I thought I'd check and see if anybody found a resolution to this issue?

We experienced it today for the first time, as we just switched to Sophos Intercept X but haven't made an update to the Palo Alto firewalls.

Re: Recent Sophos update has broken HIP checks on Global Protect

RobertShawver — Wed, 14 Sep 2022 12:32:33 GMT

Our workaround was to have the guy install the free Avast.

Re: Recent Sophos update has broken HIP checks on Global Protect

GCBS_IT — Wed, 14 Sep 2022 15:35:37 GMT

Hi Robert,

We actually tried Avast yesterday, too. It wouldn't enable Real Time Scanning because of the Sophos product being there -- even though we had disabled 'Live Protection' and Real Time Scanning. (I'm starting to wonder if you're not with the same organization as "Jeff V.". 😀)

Re: Recent Sophos update has broken HIP checks on Global Protect

RobertGoodall — Thu, 13 Oct 2022 06:32:13 GMT

I have just run into the same issue and this is fixed in 6.0.3 but I have not tried any other versions to see the same.

Re: Recent Sophos update has broken HIP checks on Global Protect

Steph01 — Thu, 13 Oct 2022 07:46:01 GMT

We upgraded to 6.1.0 GP client and it resolves the issue

Re: Recent Sophos update has broken HIP checks on Global Protect

BrentA — Thu, 16 Feb 2023 03:30:30 GMT

DId you ever get a fix for this? I have the same problem with version 2022.4.1.1.