Overview ✨
If the Liongard Sophos Firewall Inspector fails with an ETIMEDOUT message even though the firewall appears reachable, the issue may not be basic network connectivity. In some cases, the firewall API endpoint responds, but the request still fails because of authentication or credential-format behavior on the Sophos side.
🗒️ Important: A repeated ETIMEDOUT error does not always mean the firewall is down, the port is closed, or the Liongard Agent cannot reach the device. If connectivity tests succeed from the same Agent host, review the API user configuration and password format before continuing with network troubleshooting.
What this looks like
You may see an error similar to the following during inspection:
Unable to reach https://<firewall-ip>:4444/webconsole/APIController?reqxml=<Request><Get><WebProxy></WebProxy></Get></Request> because of ETIMEDOUT: connect ETIMEDOUT <firewall-ip>:4444.
The inspector logs may also show entries similar to:
Axios Error: connect ETIMEDOUT <firewall-ip>:4444
Problem calling https://<firewall-ip>:4444/webconsole/APIController...
Even with that message, the firewall may still be reachable from the Liongard Agent system.
Ref:
‼️ Note: This article references port 4444 for understanding purposes. Depending on your environment, Inspector configuration, and firewall settings, the actual port in use may differ.
What this usually means
When this issue occurs alongside successful manual connectivity tests, the most likely causes are configuration or authentication conditions at the firewall API layer rather than a failed TCP connection.
API access may be enabled, but the API user may still be blocked by policy or authentication behavior.
The API endpoint may respond to manual tests while rejecting the login request used during inspection.
Password formatting can affect API authentication on some Sophos Firewall firmware versions.
MFA or OTP-related behavior may interfere with API access for the configured user.
⚠️ Known Sophos API limitation: Some Sophos Firewall firmware versions do not support certain characters in API user passwords, even if the user account can be created successfully in the firewall interface.
Known password limitations
For Sophos Firewall API users, password and username formatting matter.
The username must not contain special characters.
Some Sophos Firewall firmware versions may not support the following characters in the password when used through the API:
#, $, @,and in some cases!.In few cases, the character
^also caused the API authentication flow to fail.
This means a user may appear valid in the firewall UI and still fail when the same credentials are used through the API.
✅ Best practice: If the inspector is failing and connectivity has already been confirmed, test with a new API user that uses a simple password containing only letters, numbers, and non-problematic symbols.
Before you troubleshoot deeper
Confirm the standard setup requirements first.
API access is enabled on the firewall.
The Liongard Agent IP address is listed in the firewall's allowed IP list for API access.
HTTPS access is enabled for the relevant interface, such as LAN or VPN.
The inspector is configured to use port 4444.
The API user is an administrator-type user with a read-only profile.
The selected group and access policy allow the account to authenticate without interactive OTP or MFA interruption.
The username does not contain special characters.
The password avoids known problematic characters.
Recommended validation steps
From the same machine running the Liongard Agent, confirm the firewall is reachable on port 4444.
Confirm that the firewall presents an HTTPS service on that port.
Verify that API access is enabled and that the Agent IP is allowlisted.
Review the API user profile, group assignment, and authentication requirements.
If the account uses an MFA or OTP bypass mechanism, confirm that the bypass is still active and applied to the correct user.
Create a new test API user if needed.
Use a simplified password that avoids known problematic characters.
Update the inspector with the new credentials and run it again.
Manual API test
If you want to confirm whether the issue is related to API authentication rather than basic connectivity, test the endpoint manually from the Agent host.
curl -k -G "https://<FIREWALL_IP>:<PORT>/webconsole/APIController" \ --data-urlencode "reqxml=<Request><Login><Username><USERNAME></Username><Password passwordform='plain'><PASSWORD></Password></Login><Get><WirelessNetworks></WirelessNetworks></Get></Request>"
If the firewall is reachable but the response indicates an authentication problem, focus on the API user, password content, or OTP/MFA behavior.
⭐️ Tip: Run the manual API test from the exact system hosting the Liongard Agent. Testing from a different workstation can hide IP allowlist, routing, or local security differences.
How to resolve it
Create or update the Sophos API user used by the inspector.
Ensure the username contains no special characters.
Use a password that avoids characters known to fail in some firmware versions, including
#, $, @,and possibly!.If you are currently using
^in the password, replace it with a different character and test again.Confirm the account is not being challenged by MFA or OTP requirements during API use.
Save the updated credentials in the Liongard Sophos Firewall Inspector configuration.
Run the inspector again.
If the inspection succeeds after changing the password format, the root cause was an API credential compatibility issue on the firewall rather than a network timeout.
How to tell this apart from a real connectivity problem
Check | Likely interpretation |
Port 4444 is unreachable from the Agent host | Likely a genuine network, routing, firewall, or service availability issue |
TLS handshake to the firewall succeeds | HTTPS service is reachable; continue with API and credential checks |
Manual unauthenticated API request returns an HTTP response | The endpoint is reachable; the problem is likely beyond basic connectivity |
Manual authenticated API request fails | Likely credential, policy, MFA, or password-format issue |
Inspection succeeds after changing password characters | Confirms API credential compatibility issue on the firewall |
When to contact Sophos
Contact Sophos if all of the following are true:
The firewall is reachable from the Liongard Agent host.
API access is enabled.
The Agent IP is allowlisted.
HTTPS access is enabled on the correct interface.
The API user is configured according to the documented requirements.
You have tested with a simplified username and password.
You still receive authentication-related failures or inconsistent API behavior.
In that case, the remaining issue is likely specific to firewall behavior, firmware handling, or account authentication policy.