This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Install Sophos on a non-domain machine over remote VPN

Hello,

I need to install Sophos on machines that are connected via a Site-to-Site VPN and are NOT on the

Domain. These machines are also not connected to the Internet and also do not allow for any sort of

drive mappings to the LAN either. The only ports allowed are 8192, 8194 and Remote Desktop to the

LAN. I would like to manage these non-domain machines using Enterprise Console, so I can update

them and push out policies if needed.

The Sophos Server is in the LAN and on the domain and is also the only Update Manager. I have gone through the documentation for creating a standalone installer, since I can't access the Sophos

share from the non-domain clients, but am unsure as to how the non-domain clients get the updates.
The LAN clients are set to update using an UNC path - \\ServerA\SophosUpdate, but how does it work

through the VPN. I'm assuming I would have to enable some more ports so it can talk to

\\ServerA\SophosUpdate, or does the 8192 port take care of that? Also, I would have to probably setup a hosts file to point to the IP for ServerA since there's no DNS on the remote machine.
Does this sound like something that would work, or is there a better way to do this without adding any other machines? Any help advice is appreciated.


Thank you,
ARIT

:33483


This thread was automatically locked due to age.
Parents
  • HI,

    Yes, the absolute minimum to alow a client to update and message is to open 3 ports on the server:

    • 8192 and 8194 TCP (incoming) for RMS
    • updating over HTTP for example TCP 80 (incoming).

    Ideally the server could also connect to the client on TCP 8194, so if you change a policy for the client in SEC for example, the server can notify the client that there is an outstanding policy for it to pickup.  If this "notification" doesn't happen, the client polls the server every 15 minutes for messages and would pick it up then.

    Regards,

    Jak

    :33723
Reply
  • HI,

    Yes, the absolute minimum to alow a client to update and message is to open 3 ports on the server:

    • 8192 and 8194 TCP (incoming) for RMS
    • updating over HTTP for example TCP 80 (incoming).

    Ideally the server could also connect to the client on TCP 8194, so if you change a policy for the client in SEC for example, the server can notify the client that there is an outstanding policy for it to pickup.  If this "notification" doesn't happen, the client polls the server every 15 minutes for messages and would pick it up then.

    Regards,

    Jak

    :33723
Children
No Data