Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 7188 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DMZ servers

Leto

Hello,

I am fairly new to Sophos. I have via the console pushed the AV install to most of my user machines and a good portion of my domain servers. My next implementation is my DMZ servers. So what's the best\recommended method of accomplishing this?

Thanks,

:34651


This thread was automatically locked due to age.
Parents
  • 0

    Hello Leto,

    it depends, naturally, on the setup of your DMZ. IMO install is secondary, the main question is what's necessary for daily operation.

    First the servers have to update their definitions. Usually this is done by connecting to a share (UNC path) and this requires NetBIOS. If you don't want NetBIOS connections to/from your DMZ you'd have to use HTTP as updating method (and consequently publish the CID with a webserver).

    As you likely want to manage Sophos on your DMZ servers from the console you have to open the necessary ports between the DMZ and your internal network.

    To simplify the administration of the firewall you could install an additional SUM (update manager, see chapter 7 in the Startup Guide) in the CID which also acts as a message relay.  Thus you'd have to open the ports between the management server and the SUM/relay in the DMZ.

    Finally the install - Protect Computers from SEC requires a level of access to the servers in the DMZ you probably don't want to allow. If you install a SUM in the DMZ and let the servers update from a UNC path you can run the setup manually from there. If you decide that the servers update only via HTTP you'd have to create a package for the install.

    Feel free to ask if you have further questions

    Christian

    :34679
Reply
  • 0

    Hello Leto,

    it depends, naturally, on the setup of your DMZ. IMO install is secondary, the main question is what's necessary for daily operation.

    First the servers have to update their definitions. Usually this is done by connecting to a share (UNC path) and this requires NetBIOS. If you don't want NetBIOS connections to/from your DMZ you'd have to use HTTP as updating method (and consequently publish the CID with a webserver).

    As you likely want to manage Sophos on your DMZ servers from the console you have to open the necessary ports between the DMZ and your internal network.

    To simplify the administration of the firewall you could install an additional SUM (update manager, see chapter 7 in the Startup Guide) in the CID which also acts as a message relay.  Thus you'd have to open the ports between the management server and the SUM/relay in the DMZ.

    Finally the install - Protect Computers from SEC requires a level of access to the servers in the DMZ you probably don't want to allow. If you install a SUM in the DMZ and let the servers update from a UNC path you can run the setup manually from there. If you decide that the servers update only via HTTP you'd have to create a package for the install.

    Feel free to ask if you have further questions

    Christian

    :34679
Children
No Data