Sophos: Internet Down — Is It the Firewall?

Category: Sophos Firewall · Audience: Customers & Technicians · Est. time: 10–20 min

Summary

When the whole office loses internet, the cause is usually the ISP/modem, sometimes the firewall, occasionally the internal network. These checks find where the break is before anyone touches the firewall config.

⚠️ Don't change firewall settings while diagnosing an outage unless you know the cause — you can make it worse. Work through the checks first.

First: is it everyone or just you?

• Just one PC/user → not the firewall/internet; troubleshoot that device (Wi‑Fi/cable/DNS).
• Everyone → continue below.

Check the chain (modem → firewall → network)

1. ISP / modem. Look at the modem/NTD lights — are the internet/line lights normal or red/off? A red line light usually means an ISP outage — check the ISP's status page or call them.
2. Power‑cycle the modem (customer, if safe): power off 30 seconds, back on, wait 2–3 minutes for it to sync. Retry.
3. Firewall reachable? From a wired PC, can you open the firewall console (https://<firewall-ip>:4444)? If the firewall is up but no internet, it points to the ISP/modem side (WAN). If the firewall itself is unreachable, it may be powered off/crashed.
4. Firewall WAN status (Technician). In the Sophos console → Control Center / Interfaces, is the WAN up with a public IP? A down WAN or lost DHCP/PPPoE from the ISP = ISP/line issue.
5. Firewall health (Technician). Check for high load, a failed failover/SD‑WAN link, or a recent config/firmware change that lines up with the outage. Sophos can roll back firmware/config if a change caused it.
6. Internal network. If the firewall has internet but PCs don't, suspect the core switch/DHCP/DNS between them.

Restore quickly

• ISP outage: if there's a 4G/failover link, confirm it took over; otherwise it's a wait/ISP ticket.
• Firewall crashed: a controlled reboot may restore it (technician, with BBN aware).

If that doesn't work

• Escalate to BBN Support immediately for a site‑wide outage with: modem light status, whether the firewall console is reachable, and any recent changes.

Prevention

• Consider a backup internet link (4G/second ISP) with automatic failover for critical sites.