Sophos Mobile
4 Ports and protocols
This section lists the communication details for required and optional network connections.
From the internet to the Sophos Mobile server
Port forwarding, NAT, WAF, Reverse Proxy are supported.
Protocol Port
HTTP 80
HTTPS 443
Destination
<Sophos Mobile server>
<Sophos Mobile server>
Comment
Forwards to HTTPS port
Access to Sophos Mobile
Admin and Self Service Portal, device sync, UTM, NAC
Optional?
Yes
From the internal network to the Sophos Mobile server
Protocol Port
HTTP 80
HTTPS 443
Destination
<Sophos Mobile server>
<Sophos Mobile server>
Comment
Forwards to HTTPS port
Access to Sophos Mobile
Admin and Self Service Portal, device sync, UTM, NAC
Optional?
Yes
From the Sophos Mobile server to the Internet
Note
A proxy can be used for this traffic. Make sure it can access the APNs servers and keeps the client certificate for services.sophosmc.com
intact.
Protocol Port
443 HTTPS with client cert.
HTTPS 443
Destination services.sophosmc.com
(85.22.154.49) android.googleapis.com
fcm.googleapis.com/fcm/send
Comment
For push notifications to Apple
(APNs), Microsoft (MPNS,
WNS), Android (Baidu Push) devices
Google Firebase Cloud
Messaging for Android devices
Optional?
16 Copyright © Sophos Limited
Comment
Apple Push Notification service
Sophos Mobile
Optional?
Protocol Port
APNs with client cert.
443
HTTPS 443
HTTPS 443
HTTPS 443
HTTPS 443
HTTPS 443
HTTPS
HTTPS
HTTPS
HTTPS
HTTPS
443
443
443
443
443
Destination api.push.apple.com
(17.0.0.0/8) vpp.itunes.apple.com
(17.0.0.0/8) itunes.apple.com (17.0.0.0/8)
Apple Volume Purchase
Program
Apple app identifier search deviceservicesexternal.apple.com (17.0.0.0/8)
Apple Activation Lock Bypass for supervised devices mdmenrollment.apple.com
(17.0.0.0/8) login.live.com
*.notify.windows.com
Apple Device Enrollment
Program
Windows Push Notification service www.googleapis.com
www.google.com/recaptcha/ api/siteverify
Android Enterprise
Google reCAPTCHA service for password reset and token enrollment login.microsoftonline.com
graph.microsoft.com
Intune app protection, federated authentication with
Azure AD
TeamViewer integration login.teamviewer.com
webapi.teamviewer.com
start.teamviewer.com
One of the following Sophos
Central regions: smc-device-if-cloudstation-euwest-1.prod.hydra.sophos.com
smc-device-if-cloudstation-eucentral-1.prod.hydra.sophos.com
smc-device-if-cloudstation-uswest-2.prod.hydra.sophos.com
smc-device-if-cloudstation-useast-2.prod.hydra.sophos.com
Migration from a Sophos
Mobile on-premise installation or Sophos Mobile as a Service to Sophos Central
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Copyright © Sophos Limited 17
Sophos Mobile
From the Sophos Mobile server to the following internal hosts
Destination Protocol
MS SQL
MySQL
SMTP plain
SMTP
SSL
SMTP
TLS
LDAP
LDAPS
HTTPS
HTTPS
Port
1433
3306
25
465
587
389
636
443
443
<your database host>
<your SMTP host>
<your LDAP host>
Comment
Only if on a different computer than Sophos Mobile
Optional?
Enrollment and maintenance emails
To your directory server
<your Exchange server> For ActiveSync traffic
<your SGN server> For SGN integration
Yes
Yes
Yes
From Android devices to the internet (if connected via Wi-Fi)
Service Port
FCM
Destination
5228-5230 internet
(all IP blocks listed in Google’s
ASN 15169 )
HTTPS
HTTPS
443
443 www.googleapis.com
*.samsungknox.com
*.secb2b.com
*.samsung.com
Comment
Google Firebase Cloud
Messaging (FCM) for Android devices.
IP ranges might change regularly. If you use IP restrictions, check the ASN
15169 document at least monthly.
Zero-touch enrollment
Samsung Knox Mobile
Enrollment
Optional?
Yes
Yes
18 Copyright © Sophos Limited
Sophos Mobile
From iOS and macOS devices to the internet (if connected via Wi-Fi)
Service Port
APNs 5223
HTTPS 443
HTTPS 443
Destination
17.0.0.0/8 mesu.apple.com
push-services.sophosmc.com
Comment
Apple Push Notification service for iOS and macOS devices.
Apple service for available iOS and macOS updates.
Sophos notification service for the Sophos Secure Email iOS app.
Optional?
Yes
1
Yes
2
From Windows and Windows Mobile devices to the internet (if connected via Wi-Fi)
Service Port
HTTPS 443
Destination
*.notify.windows.com
*.wns.windows.com
*.notify.live.net
Comment
Windows Notification Service
(WNS) and Microsoft Push
Notification Service (MPNS) for
Windows devices.
Optional?
Between Sophos Mobile server nodes
Protocol Port
TCP 7600, 8181, 57600
TCP
UDP
7600, 8181, 57600
45700
Destination
<incoming>
<outgoing>
<incoming>
Comment Optional?
1
2
If not available, Sophos Mobile has no information about iOS and macOS updates. For example, compliance rules regarding mandatory updates have no effect.
Required to use Exchange Web Services (EWS) notifications. See Sophos knowledge base article
127137 .
Copyright © Sophos Limited 19
