Sophos Firewall App control without Endpoint Agent?

Hi Wolfgang,

Thank you for reaching out to Sophos Community.

Having a third-party antivirus and no Endpoint won’t affect the Firewall Application control. This feature lets you control which applications users can access by analyzing and intercepting traffic.

For Sophos Firewall Application Filter,  you may check the following KB

https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Applications/HowToArticles/BlockApplicationsUsingApplicationFilter/index.html#add-rules-to-the-policy

1. To Identify the traffic and app that tries to make a connection. You may check your log viewer to give us a better understanding. This will also help you further check the issue with the " One PC" having issue

• https://support.sophos.com/support/s/article/KB-000038056?language=en_US

Hi Erick, thank you for your quick response.

Do you know if Sophos explains somewhere the principle of operation of Firewall Application control w/o Sophos Endpoint? Does it just guess the application from the traffic behavior? And if so: how reliable can it be?

And are you sure that a blocked app would show up in the log viewer? I investigated earlier and I could not see any block and I wonder if a second look will be worthwhile.

Thanks again, regards, Wolfgang

Hi,

there's a detailed explanation in the KBA. I will try a simplified version.

Implementation  requires

1/. create your own application policy

2/. install CA on end devices

3/. use IPS in the firewall rule

4/. I prefer to use the web proxy as well with my own policy

5/. I also use a drop/reject firewall rule with the IP address of the site/s

What you will observe in logviewer 

1/. in the firewall view you will see that the application is allowed

2/. in the application view you weill see the application blocked

Daily  report

1/. shows the application is passing traffic

2/. the next section (blocked) will show the application is blocked.

The process for application blocking relies on packet inspection so that is why you see apparently valid traffic, where as the web blocking is done on URL.

I hope this simplified explanation helps?

Ian