Windows Firewall Rules

The configuration will depend on what modules that you are using within Sophos. Are you just referring to endpoint hosts or also SUMs?

The following table shows which ports used based on the function.

Hi Azurus,

I've managed to find that list from the knowledgebase too.  Was actually wanting to know about restricting the windows firewall rule for RouterNT.exe.

Comments anyone?

Is the host(s) reporting to a SUM or directly to the Enterprise Console server? It seems to me that you have already kind of answered your own questions in a way. Not much else you could do to lock down the ruleset.

These rules above do apply to Windows Firewall settings. These are the ports that RouterNT.exe will use.

1. I want to harden the rules so what is recommended?

Lock down the rule by explicit assignment of the destination ip.
 

  2. Is this rule only needed for outbound and not inbound rules (or vice versa)?

I believe the 8192 - 8194 ports are used for inbound and outbound

  3. Should I specify Local IP Address as the endpoint and the Remote IP Address as the Sophos server?

Could just use LOCALHOST and, yes the sophos server as the destination.

  4. Can I restrict the protocols to TCP on local & remote ports 8192-8194 (or other)?

Yes you can. Sophos does not use UDP protocol for these ports.

  5. Should I specify the Sophos server in Authorized Computers rather than in the Scope?

Either or both.

I would have PM'd you, Azurus, but you have it off. Great post, but the links to the articles should be absolute

Thanks

Christian

With regards to RouterNT.exe.  The Sophos firewall will automatically allow this process.  For non Sophos Firewalls the following rules are required:

RouterNT.exe on the SEC Server
INCOMING
TCP
Ports 8192 and 8194

RouterNT.exe on a message relay

INCOMING 
TCP
Ports 8192 and 8194

RouterNt.exe on a client machine
INCOMING
TCP
Port 8194

The "client" router will operate without allowing any incoming a ports as long as it can connect to the parent router on ports 8192 and 8194.  In this mode the server will not be able to send messages to the client machine. In this scenario the system will rely on the client router checking for messages (polling).  By default this is every 15 minutes.  So to ensure you can send action messages and configurations immediately you will need to open port 8194 on the client.

Note: The local agents that logon to the router, e.g.. ManagementAgentNT.exe process will connect locally to port 8192 and 8194.  On the server this will also include the mgntsvc.exe, the certification manager service and EMLibupdate agent.

Regards,
Jak

I am finding out slowly that my co-worker is shutting down the Windows firewall to just about anyone that can not update the anti-virus.  I have explained to my boss that this is a bad idea and now I am asking you.
What ports/program do I need to allow through the Windows firewall for sophos to update via a local server?

Any and all assistance is appreciated.

Thank you

Dave-Kilborn

Pacific Crest Securities Administrator

The post above yours by Jak explains the answer to your question about as best as it could be answered.

---

Dave-Kilborn wrote:

What ports/program do I need to allow through the Windows firewall for sophos to update via a local server?

---

For updating...'File and Printer Sharing' has to be enabled.  Ports: TCP 445, UDP 137, 138 and UDP 139

Jak's answer is regarding allowing the Remote Management System (RMS) component through a firewall - so you can manage (control) the client from the console.

For more details on deploying, managing, and allowing updating of endpoint software please see:

How to configure a GPO to ensure that you can protect and manage computers with endpoint software

or

How to locally configure computers to ensure that you can protect and manage computers with endpoint software centrally

The absolute minimum number of ports required to open for both RMS and updating to work from SEC server to client would be:

Updating:

Create a web CID, rather than a UNC share for the client to update from. This way on the server you just open one INCOMING TCP port, e.g. 80.

RMS:

TCP 8192 INCOMING on the the management server.

TCP 8194 INCOMING on the the management server .
 

In theory on the client you don't have to open any incoming ports and it would still work.

On the client, the RouterNT.exe process would need to connect to the server on the above TCP ports, i,e, 8192, 8194.
On the client, the alupdate.exe process would need to connect to the web server on TCP 80 for example.
Both these files are allowed through the Sophos Client Firewall due to the SCF.dat files in the same directories.

I would still advise where possible to open INCOMING 8194 on the client to ensure than the server RouterNT.exe can send downstream messages to the client RouterNT.exe in a timely fashion.  As I said before, if you don't, server to client message delivery will be delayed by up to 15 minutes by default.

Regards,

Jak