Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG blocking Apple OS Software & Updates

SFVH (SFOS 18.5.1 MR-1-Build326)

I found an old post that listed things to add to the web content exceptions. 

I noticed the third one in their list was missing from the exception that was apparently included in the appliance defaults, so I cloned the existing exception and added the missing string to the new one, but am still unable to install OS X and am still being blocked from the Apple online recovery tooling.

Apple Update New
Allows Apple Update without content scanning side effects.
Matching URLs:
^([A-Za-z0-9.-]*\.)?apple\.com\.?/
^([A-Za-z0-9.-]*\.)?cdn-apple\.com\.?/
^([A-Za-z0-9.-]*\.)?icloud\.com\.?/
^([A-Za-z0-9.-]*\.)?mzstatic\.com\.?/
After the change I am still unable to run the online System Recovery (CMD+Shift+R) and complete the required downloads.  The error is:

support.apple.com/mac/startup
-1008F

I am also still getting errors when attempting to install from disk image on a machine that already has a working OS, stating that it is unable to download required software to install the new OS.

I will keep working at it, but if anyone knows a workaround, I definitely suspect the black magic inside the Sophos appliance as the culprit since it seems to cause so many issues and I simply cannot find a view that shows me what it is blocking in realtime, or specifically.

Thanks.



This thread was automatically locked due to age.
Parents
  • I had a similar issue with doing an internet restore of Monterey last week and had to add the following in addition to the other Apple domains listed in other replies to your post:

    www-mail.icloud-sandbox.com
    edge-022.usbos2.icloud-content.com
    cdn.apple-cloudkit.com
    api.apple-cloudkit.com

  • ^ This is the answer. No need to mess with firewall rules or FQDN patterns. In Local TLS Exclusion list, I have:
       apple.com
       icloud.com
       me.com
       iCloud-content.com
    Note these are domain names, no need to specify hosts in the domain. Upgrades work for me. Haven't tried Apple online recover tools.

    Just look for in the TLS log for the Apple domains that are being accessed and add them to the Local TLS Exclusion list. You're not looking for Rejects or failures because as far as the Sophos is concerned, everything's good. It's Apple that doesn't like the MiTM used for TLS inspection.

  • my list is built from resolving Apple device access after each Apple software upgrade. Also the FQDN lists are automatically polluted by XG. Even with the SSL/TLS exceptions v18.5.1 broke the update process.

    Ian

Reply Children
No Data