This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

sophostest.com - unable to test due to Sophos Scan exclusion recommendations

Hey, I cannot test our XG with the test site, you are providing: https://sophostest.com/

I've asked this once but forgot. Today I wanted to verify something but could'nt even find the request in the web filter log.

Of course, I could browse all the bad test sites.

This is because your test site is running on the same could servers, probably cloudfront.net, as you use for Sophos / Central services. And for those cloud servers (FQDN) there are http/https exceptions and the requests are not even scanned by webfilter.

Bad design for a (malware) test-site.

Can you please put the site on some stand-alone server so we can use it for testing the filters?

during my tests the site had the IP

13.225.87.17

This thread was automatically locked due to age.

Top Replies

Prism over 3 years ago in reply to LuCar Toni +1

He wants to use the Sophos Test website to test web filtering or AV, but can't because the recommended exclusions by Sophos also excludes sophostest.com

0 LuCar Toni over 3 years ago

Try http://sophostest.com
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog over 3 years ago in reply to LuCar Toni
Why? there are http and https rules towards to the Sophos / Central servers.

https://docs.sophos.com/central/Customer/help/en-us/central/Customer/concepts/DomainsPorts.html

Ports

You must add the following ports.

80 (HTTP)

443 (HTTPS)

and really, this sucks: *.cloudfront.net, amazonaws.com
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to LHerzog

Maybe i am not able to understand, what you actually try to perform?
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog over 3 years ago in reply to LuCar Toni

I sit behind an XG and want to see that it blocks

but it does'nt
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to LHerzog

What do you want to block and how?
Cancel
Vote Up 0 Vote Down

Cancel
0 Prism over 3 years ago in reply to LuCar Toni

He wants to use the Sophos Test website to test web filtering or AV, but can't because the recommended exclusions by Sophos also excludes sophostest.com
Cancel
Vote Up +1 Vote Down

Cancel
0 LHerzog over 3 years ago in reply to Prism

thanks :-)
Cancel
Vote Up 0 Vote Down

Cancel
0 Prism over 3 years ago in reply to LHerzog

The easiest fix is to create another Rule on top of the recommended exclusions with a FQDN of sophostest.com with all filtering and AV enabled; Well, It should work.

Edit: Why is there a wildcard for cloudfront, lmao.
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog over 3 years ago in reply to Prism

I thought of that, but I think it will have bad impact on Central / Intercept-X communication.

In the logs I can see that a lot of computers are communicating with the IPs belonging to sophostest.com
Cancel
Vote Up 0 Vote Down

Cancel
0 Prism over 3 years ago in reply to LHerzog

Then open a support case.

But I don't think anything will change.
Cancel
Vote Up 0 Vote Down

Cancel

sophostest.com - unable to test due to Sophos Scan exclusion recommendations

Top Replies

Ports