in https://support.sophos.com/support/s/article/KB-000035545?language=en_US it is confusing sentence in part "Device deployement" (I add comments in red).
"Therefore activate NTP on the Sophos Firewall (clear) and allow the correct network or at least the IP address of the RED (what you mean by that - in firewall?)."
