Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 29 subscribers
  • Views 2556 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG blocking Apple OS Software & Updates

James Scollard1

SFVH (SFOS 18.5.1 MR-1-Build326)

I found an old post that listed things to add to the web content exceptions. 

I noticed the third one in their list was missing from the exception that was apparently included in the appliance defaults, so I cloned the existing exception and added the missing string to the new one, but am still unable to install OS X and am still being blocked from the Apple online recovery tooling.

Apple Update New
Allows Apple Update without content scanning side effects.
Matching URLs:
^([A-Za-z0-9.-]*\.)?apple\.com\.?/
^([A-Za-z0-9.-]*\.)?cdn-apple\.com\.?/
^([A-Za-z0-9.-]*\.)?icloud\.com\.?/
^([A-Za-z0-9.-]*\.)?mzstatic\.com\.?/
After the change I am still unable to run the online System Recovery (CMD+Shift+R) and complete the required downloads.  The error is:

support.apple.com/mac/startup
-1008F

I am also still getting errors when attempting to install from disk image on a machine that already has a working OS, stating that it is unable to download required software to install the new OS.

I will keep working at it, but if anyone knows a workaround, I definitely suspect the black magic inside the Sophos appliance as the culprit since it seems to cause so many issues and I simply cannot find a view that shows me what it is blocking in realtime, or specifically.

Thanks.



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    you need to setup a firewall rule that has no web checking, allow all in applications and IPS. On my XG I have setup a firewall rule that allows all the apple devices to talk to Apple sites without any checks using a limited series of ports. 

    You will not find any errors, the issue is the apple software does not like man in the midddle scanning and fails to update even though the logviewer shows successful connections.

    The screenshot below is the apple services group and the FQDN group (only works in IP4 and SSL/TLS). I use these to ensure general internet access uses the scanning rules. The Apple FQDN group is too long to post a full screenshot. I also have the same web exceptions as you and use the proxy without any scanning because it is less intrusive than DPI. SSL/TLS broke my Apple access rule after the v18.5..2 MR-2 update and I have not investigated which part, I reverted to the firewall rule and proxy. IPv6 has a more general access because of the lack of security features in the XG version of IPv6.

    Ian

  • 0 in reply to rfcat_vk

    I can probably create something resembling your "Apple FQDN Group" from here:

    https://support.apple.com/en-us/HT210060

    Giving it a try...

Reply Children
No Data