Sophos Patch Management Assessment - remote cache

Question

Hi, 
 Just looking for some help from anyone who might be familiar with the Patch Assessment tool. 
 I have a central install of the Sophos Enterprise Console, and a number of remote sites where the Update Manager is installed. I tried following the instructions here - https://community.sophos.com/kb/en-us/117121 - in order to configure remote caches for the mcescan.cab which is currently around 202MB in size. I can't get this to work however, and so my central install server tries to update every remote PC over our site VPN's... not good when we only have a 10Meg link and 200 computers to update. It only updates a couple of times a month so I can probably live with it. 
 Does anyone know how to set this up properly? 
 I've got a support case open with Sophos, but they've been unable to help. 
 Regards, 
 Richard

QC · Accepted Answer

Hello Richard, 
 I have no knowledge of the internals, running another test suggests that the Agent tries the PrimaryServerUrl as fallback. 
 The proxy servers I'm using only have Sophos Update Manager ... but no proxy software if I understand correctly. There's no proxy (not even a web server) functionality built into SUM or SEC. Like with WebCIDs you have to supply your own web server for this. IIS is probably not the best choice for your purpose. A viable alternative is Squid . Dunno about its footprint, it can do much more than what you need but perhaps you can find some other use as well. 
 Christian

QC · Answer

Hello Richard, 
 it works with http:// (I didn't test without) so unless you are the adventurous type use it. A request to an explicit proxy must contain the final destination so you need the PrimaryServerUrl as well. If there are connections from multiple workstations then they don't pick up the PrimaryProxyServerUrl ... oops! I just notice that article 117121 is in error as it advises to set the values on the 32bit ( Wow6432Node ) node. Actually it's always HKLM\SOFTWARE\Sophos\Sophos Patch Agent\ and as I assume you have 64bit endpoints this might be the reason for the direct connections (and this would also explain why you've asked about setting the PrimaryServerUrl ). 
 Christian