Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 29 subscribers
  • Views 2552 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG blocking Apple OS Software & Updates

James Scollard1

SFVH (SFOS 18.5.1 MR-1-Build326)

I found an old post that listed things to add to the web content exceptions. 

I noticed the third one in their list was missing from the exception that was apparently included in the appliance defaults, so I cloned the existing exception and added the missing string to the new one, but am still unable to install OS X and am still being blocked from the Apple online recovery tooling.

Apple Update New
Allows Apple Update without content scanning side effects.
Matching URLs:
^([A-Za-z0-9.-]*\.)?apple\.com\.?/
^([A-Za-z0-9.-]*\.)?cdn-apple\.com\.?/
^([A-Za-z0-9.-]*\.)?icloud\.com\.?/
^([A-Za-z0-9.-]*\.)?mzstatic\.com\.?/
After the change I am still unable to run the online System Recovery (CMD+Shift+R) and complete the required downloads.  The error is:

support.apple.com/mac/startup
-1008F

I am also still getting errors when attempting to install from disk image on a machine that already has a working OS, stating that it is unable to download required software to install the new OS.

I will keep working at it, but if anyone knows a workaround, I definitely suspect the black magic inside the Sophos appliance as the culprit since it seems to cause so many issues and I simply cannot find a view that shows me what it is blocking in realtime, or specifically.

Thanks.



This thread was automatically locked due to age.
  • 0

    Hi,

    you need to setup a firewall rule that has no web checking, allow all in applications and IPS. On my XG I have setup a firewall rule that allows all the apple devices to talk to Apple sites without any checks using a limited series of ports. 

    You will not find any errors, the issue is the apple software does not like man in the midddle scanning and fails to update even though the logviewer shows successful connections.

    The screenshot below is the apple services group and the FQDN group (only works in IP4 and SSL/TLS). I use these to ensure general internet access uses the scanning rules. The Apple FQDN group is too long to post a full screenshot. I also have the same web exceptions as you and use the proxy without any scanning because it is less intrusive than DPI. SSL/TLS broke my Apple access rule after the v18.5..2 MR-2 update and I have not investigated which part, I reverted to the firewall rule and proxy. IPv6 has a more general access because of the lack of security features in the XG version of IPv6.

    Ian

  • 0 in reply to rfcat_vk

    I can probably create something resembling your "Apple FQDN Group" from here:

    https://support.apple.com/en-us/HT210060

    Giving it a try...

  • 0

    I had a similar issue with doing an internet restore of Monterey last week and had to add the following in addition to the other Apple domains listed in other replies to your post:

    www-mail.icloud-sandbox.com
    edge-022.usbos2.icloud-content.com
    cdn.apple-cloudkit.com
    api.apple-cloudkit.com

  • 0 in reply to Brian1941

    ^ This is the answer. No need to mess with firewall rules or FQDN patterns. In Local TLS Exclusion list, I have:
       apple.com
       icloud.com
       me.com
       iCloud-content.com
    Note these are domain names, no need to specify hosts in the domain. Upgrades work for me. Haven't tried Apple online recover tools.

    Just look for in the TLS log for the Apple domains that are being accessed and add them to the Local TLS Exclusion list. You're not looking for Rejects or failures because as far as the Sophos is concerned, everything's good. It's Apple that doesn't like the MiTM used for TLS inspection.

  • 0 in reply to Wayne Folta

    my list is built from resolving Apple device access after each Apple software upgrade. Also the FQDN lists are automatically polluted by XG. Even with the SSL/TLS exceptions v18.5.1 broke the update process.

    Ian