Overview

This knowledge base article provides information on the domains and ports that are required for successful installation, registration and subsequent communication of a Sophos Central endpoint to the Sophos Central Admin, and vice versa.

Note: All features will route via the same proxy.

Applies to the following Sophos product(s)
Central Mac Endpoint
Central Sophos Anti-Virus for Linux
Central Windows Endpoint
Sophos Central Admin
Sophos Central Managed Server

Sophos Central and Sophos Central Partner

• central.sophos.com
• cloud-assets.sophos.com
• sophos.com
• downloads.sophos.com
• az416426.vo.msecnd.net
• dc.services.visualstudio.com
• *.cloudfront.net

Note: The wildcard *.sophos.com should be used to cover all of these addresses if your firewall and/or proxy supports it.

Sophos Central Endpoint Domains

The below wildcards should be used to cover these endpoint domains if your proxy and/or firewall supports it.

If your proxy or firewall does not support the use of wildcards, the listed addresses should be added manually.

Identify the server address that the Sophos Management Communication System uses to securely communicate with Sophos Central.

1. Open the file SophosCloudInstaller.log located at:
   
   Windows 2008: C:\Documents and Settings\All Users\Application Data\Sophos\CloudInstaller\Logs
   Windows 7 and later: C:\ProgramData\Sophos\CloudInstaller\Logs
   
   
2. Search within the file for the line Model::server value changed to:
   
   Note: This should look similar to dzr-mcs-amzn-eu-west-1-9af7.upe.p.hmr.sophos.com.
   
   
3. Add the server address.
4. Search within the same file for the line Opening connection to api-cloudstation
   
   Note: This should look similar to api-cloudstation-eu-central-1.prod.hydra.sophos.com
   
   
5. Add this installer server address and the following addresses to the allow list of the proxy server:

• dci.sophosupd.com
• d1.sophosupd.com
  
• d2.sophosupd.com
• d3.sophosupd.com
• dci.sophosupd.net
• d1.sophosupd.net
• d2.sophosupd.net
• d3.sophosupd.net
• t1.sophosupd.com
• sdu-feedback.sophos.com
• sophosxl.net
• 4.sophosxl.net
• samples.sophosxl.net
• ocsp.globalsign.com
• ocsp2.globalsign.com
• crl.globalsign.com
• crl.globalsign.net
• ocsp.digicert.com
• crl3.digicert.com
• crl4.digicert.com

Note: Some firewalls may display reverse lookups that may show *.amazonaws.com urls, which may cause concern as it is not a *.sophos.com url. This is an expected behavior and by design. An example is the url above: https://dzr-mcs-amzn-eu-west-1-9af7.upe.p.hmr.sophos.com. This url in particular has the IP 52.209.238.119. If this IP address is reversed looked up, it will return ec2-52-209-238-119.eu-west-1.compute.amazonaws.com.

Sophos Intercept X Advanced with EDR

For customers with an Intercept X Advanced with EDR license, the following domains are also required:

• tf-edr-message-upload-eu-central-1-prod-bucket.s3.amazonaws.com
• tf-edr-message-upload-eu-west-1-prod-bucket.s3.amazonaws.com
• tf-edr-message-upload-us-east-2-prod-bucket.s3.amazonaws.com
• tf-edr-message-upload-us-west-2-prod-bucket.s3.amazonaws.com
• live-terminal-eu-west-1.prod.hydra.sophos.com
• live-terminal-eu-central-1.prod.hydra.sophos.com
• live-terminal-us-west-2.prod.hydra.sophos.com
• live-terminal-us-east-2.prod.hydra.sophos.com
• mcs-push-server-eu-west-1.prod.hydra.sophos.com
• mcs-push-server-eu-central-1.prod.hydra.sophos.com
• mcs-push-server-us-west-2.prod.hydra.sophos.com
• mcs-push-server-us-east-2.prod.hydra.sophos.com
  

Sophos Intercept X Advanced with EDR and MTR

If a customer has the MTR feature and is performing TLS inspection or has a firewall that is doing application filtering, these domains are also required:

• kinesis.us-west-2.amazonaws.com
• prod.endpointintel.darkbytes.io

To confirm if they need to do those exclusions, or to test that the exclusions are effective, test by navigating to https://prod.endpointintel.darkbytes.io from an endpoint inside the environment. You should see a message like the following return:

{

message: "running..."

}

Sophos Central Endpoint Ports

• 80 (HTTP)
• 443 (HTTPS)

Related information

• Sophos Central Endpoint: Installer command line options for Windows and Mac
• Sophos Central Admin: Frequently Asked Questions (FAQs)
• Sophos Central Endpoint: New endpoint installer frequently asked questions
• Sophos Central Endpoint: An Internet connection could not be established

Sign up to the Sophos Support SMS Notification Service to get the latest product release information and critical issues.