Sophos endpoint specific proxy settings

Hello Jeremy Gainsford,

machines that don't have internet access
so what's the problem - that SSP is hammering against the firewall? Or that you want to let SSP through so that it can be fully functional?
AFAIK all components that consult or feedback to the cloud use the Windows system proxy settings. Under ProgramData there's a Config folder for SSP, insome of the files there are Sophos URLs that SSP connects to - perhaps you could either whitelist them in the firewall or blackhole them with \etc\hosts.

Christian

Hello Jeremy Gainsford,

machines that don't have internet access
so what's the problem - that SSP is hammering against the firewall? Or that you want to let SSP through so that it can be fully functional?
AFAIK all components that consult or feedback to the cloud use the Windows system proxy settings. Under ProgramData there's a Config folder for SSP, insome of the files there are Sophos URLs that SSP connects to - perhaps you could either whitelist them in the firewall or blackhole them with \etc\hosts.

Christian

Like I said. I'm not eager to set system wide proxy settings. The machines in question are running software which is known to be insecure. Can't change the software, it's LoB stuff that's attached to expensive hardware. So I'm tying for the least pessimal solution. 

Given that these computers are subject to 3rd party engineers turning up and sticking USB sticks in them (a practice there's organisational resistance to changing) I'm reluctant to turn off protection that Sophos describe as necessary. 

Hello Jeremy Gainsford,

so you want the Sophos components to be able to connect to the cloud but otherwise block Internet access? Is this correct?
As these connections are only to known Sophos domains IMO a network firewall should do it.

Christian

Sure, and if they were connecting to IPs rather than to host names I'd happily use a network firewall for this.

I'm assuming from your responses that there's either not a Sophos specific proxy setting, or if there is you don't know about it?

Hello Jeremy Gainsford,

you don't know
correct. The names used resolve to hosts on CDNs so the actual IPs depend on your ISP Unfortunately there's no concise and comprehensible article which names you'd have to check (the article on SXL is not overly helpful IMO). Nevertheless there are, as said, two names in the SSP config files which are likely the most important or only applicable - as you generally don't permit outside connections neither Web Protection/Control, download reputation, nor MTD/NTP should come into play.

[Edit]
It seems that the URLs ssp uses are 4.sophosxl.net and ssp.feedback.sophos.com - from "here" these resolve to 10 addresses in total.
[/Edit] 

Christian

Hi Jeremy,

To add to what QC has already mentioned (i'm currently following up with our team regarding publishing a KB that summarizes this).

Here are some related KB's that contain info you might be interested in:

• Sophos Update Manager: Timeout while attempting to connect to the specified address. There may be a problem with the network.
• Sophos Central: Domains and ports required for communication to and from Sophos Central Admin and the Sophos Central managed client software
• Sophos UTM: IP Addresses and Domains for version 9.3 and above

Regards,