How can I control Sophos update process with "Windows Firewall"?

Hello Adachi,

err, excuse me, what is it you want to do? Or: You are doing what? How come you seemingly indiscriminately block all services and processes related to Sophos?
And yes, plugging the tailpipe is one way to shut off a combustion engine.

Christian

Hi,　Christian

Thanks for your reply.

As a circumstance, the Windows server that installed Sophos Endpoint Console
is located in an area connected to the Internet, but only Sophos Update is effective,
I would like to block other external access.

It is an environment where you can not filter on Sophos's update destination such as dci.sophosupd.com etc,
so I would like to realize it by controlling the server itself.

I am planning to use Windows Firewall as a tool to control.
So I asked how to control Sophos's update with Windows Firewall.

Even if I specify Sophos Update Manager.exe and SUMservice and configure to block on port 80,
I can update, so I tried to block all Sophos related services and processes,
but eventually I can update... It is a state that I do not know how to do it.

Regards,

Adachi

Hello Adachi,

lost or added in translation (from what language)? It's a little bit confusing.
I understand you have a SEC/SUM that can connect to the Internet. Normally it's supposed to download updates from Sophos. You say you would like to block other external access - you mean, to sites other than Sophos, or? Why do you want to block the update?

Christian

Hi Christian,

The reason why I want to control Sophos Update with Windows Firewall is as follows.

In order to update from the Sophos management server, I'm considering blocking accesses other than updates from the Internet on the server,
because the port can not be narrowed down on the network.

Therefore, I think that it is necessary to specify the port to be used for Update in Windows FireWall in order to identify the port other than Update.
In order to specify the port to be used for Update, we intentionally block it, and we are carrying out verification assuming the result that Update can not be done.

For example, even if I specified Sophos Update Manager.exe and SUM service and blocked port 80 on Windows FireWall, I could update it.
Even if you specified all Sophos *** services as blocks, I could update them.
When blocking port 80, Update was not possible.
The verification method seems to be strange, but the purpose is to identify the service to be used in Sophos update.

Regards
Adachi

Hi Christian,

The reason why I want to control Sophos Update with Windows Firewall is as follows.

In order to update from the Sophos management server, I'm considering blocking accesses other than updates from the Internet on the server,
because the port can not be narrowed down on the network.

Therefore, I think that it is necessary to specify the port to be used for Update in Windows FireWall in order to identify the port other than Update.
In order to specify the port to be used for Update, we intentionally block it, and we are carrying out verification assuming the result that Update can not be done.

For example, even if I specified Sophos Update Manager.exe and SUM service and blocked port 80 on Windows FireWall, I could update it.
Even if you specified all Sophos *** services as blocks, I could update them.
When blocking port 80, Update was not possible.
The verification method seems to be strange, but the purpose is to identify the service to be used in Sophos update.

Regards
Adachi

Hello Adachi,

do I understand correctly that you want to make sure that you open just the correct port for Sophos updates - and in order to verify that you chose the right one you try to block it?

Anyway, it's SophosUpdateMgr.exe that connects on port 80 (the upcoming SUM 1.7.0 will try HTTPS/443 first before falling back to HTTP/80). Just tested it, works as expected. Please note that various Sophos processes establish inter-process connection on the loopback interface.

Christian