Sophos IPs to create a PASS-rule in Fire-Wall

You can look in the firewall logs for denies or you can do this by using tcpdump in cli (tcpdump 'host <IP OF YOUR MACBOOK> -s 0

You can look in the firewall logs for denies or you can do this by using tcpdump in cli (tcpdump 'host <IP OF YOUR MACBOOK> -s 0

Thank you for your replay - I will check at home this evening.

Maybe I forgot to activate the LOG, therefore I did not see any blocked IPs related to Sophos Antivirus for Mac ...

Yes you have to activate this in the logs (Firewall Rules) default it is not.

System Services -> Log Settings, tick Firewall Rules

the blocking protocol only showing to me following IPs:

2.16.207.69

23.63.139.27

178.79.227.60

213.46.255.39

No one of these IP indicate to me Sophos :-(

Thanks t Sophos !

This article shows the necessary information — http://sophos.com/kb/111428