Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 4 subscribers
  • Views 9478 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos endpoint specific proxy settings

Jeremy Gainsford

I'm seeing a lot of outgoing traffic from SSP.exe on machines that don't have internet access. I am reluctant to configure system wide proxy settings, but would like ideally to set a proxy specifically for SSP and other SEP components that require internet access rather than SEC connectivity. Failing that is there a way to prevent SSP from talking to the internet that can be configured from SEC?



This thread was automatically locked due to age.
Parents
  • 0

    Hello Jeremy Gainsford,

    machines that don't have internet access
    so what's the problem - that SSP is hammering against the firewall? Or that you want to let SSP through so that it can be fully functional?
    AFAIK all components that consult or feedback to the cloud use the Windows system proxy settings. Under ProgramData there's a Config folder for SSP, insome of the files there are Sophos URLs that SSP connects to - perhaps you could either whitelist them in the firewall or blackhole them with \etc\hosts.

    Christian

  • 0 in reply to QC

    Like I said. I'm not eager to set system wide proxy settings. The machines in question are running software which is known to be insecure. Can't change the software, it's LoB stuff that's attached to expensive hardware. So I'm tying for the least pessimal solution. 

    Given that these computers are subject to 3rd party engineers turning up and sticking USB sticks in them (a practice there's organisational resistance to changing) I'm reluctant to turn off protection that Sophos describe as necessary. 

  • 0 in reply to Jeremy Gainsford

    Hello Jeremy Gainsford,

    so you want the Sophos components to be able to connect to the cloud but otherwise block Internet access? Is this correct?
    As these connections are only to known Sophos domains IMO a network firewall should do it.

    Christian

  • 0 in reply to QC

    Sure, and if they were connecting to IPs rather than to host names I'd happily use a network firewall for this.

    I'm assuming from your responses that there's either not a Sophos specific proxy setting, or if there is you don't know about it?

  • 0 in reply to Jeremy Gainsford

    Hello Jeremy Gainsford,

    you don't know
    correct. The names used resolve to hosts on CDNs so the actual IPs depend on your ISP Unfortunately there's no concise and comprehensible article which names you'd have to check (the article on SXL is not overly helpful IMO). Nevertheless there are, as said, two names in the SSP config files which are likely the most important or only applicable - as you generally don't permit outside connections neither Web Protection/Control, download reputation, nor MTD/NTP should come into play.

    [Edit]
    It seems that the URLs ssp uses are 4.sophosxl.net and ssp.feedback.sophos.com - from "here" these resolve to 10 addresses in total.
    [/Edit] 

    Christian

Reply
  • 0 in reply to Jeremy Gainsford

    Hello Jeremy Gainsford,

    you don't know
    correct. The names used resolve to hosts on CDNs so the actual IPs depend on your ISP Unfortunately there's no concise and comprehensible article which names you'd have to check (the article on SXL is not overly helpful IMO). Nevertheless there are, as said, two names in the SSP config files which are likely the most important or only applicable - as you generally don't permit outside connections neither Web Protection/Control, download reputation, nor MTD/NTP should come into play.

    [Edit]
    It seems that the URLs ssp uses are 4.sophosxl.net and ssp.feedback.sophos.com - from "here" these resolve to 10 addresses in total.
    [/Edit] 

    Christian

Children
No Data
Unfiltered HTML