Sophos Mobile on Premise
4 Ports and protocols
This section lists the communication details for required and optional network connections.
From the internet to the Sophos Mobile server
Port forwarding, NAT, WAF, Reverse Proxy are supported
Protocol Port
HTTP 80
HTTPS 443
Destination
<Sophos Mobile server>
<Sophos Mobile server>
Comment
Forwards to HTTPS port
Access to admin console, self service portal and device sync,
UTM, NAC
Optional?
Yes
From the internal network to the Sophos Mobile server
Protocol Port
HTTP 80
HTTPS 443
Destination
<Sophos Mobile server>
<Sophos Mobile server>
Comment
Forwards to HTTPS port
Access to admin console, self service portal and device sync,
UTM, NAC
Optional?
Yes
From the Sophos Mobile server to the Internet
Note
A proxy can be used for this traffic. Make sure it can access the APNs servers and keeps the client certificate for services.sophosmc.com
intact.
Protocol Port
HTTPS with client cert.
443
HTTPS 443
HTTPS 443
Destination services.sophosmc.com
(85.22.154.49) android.googleapis.com
gcm-http.googleapis.com
www.google.com/recaptcha
Comment
Used for SMC App Push - Apple
(APNs), Microsoft (MPNS,
WNS), Android (Baidu Push)
Optional?
Google Cloud Messaging for
Android devices
Google reCAPTCHA service
Copyright © 2018 Sophos Limited 9
Sophos Mobile on Premise
Protocol Port
HTTPS 443
Destination www.googleapis.com
APNS with client cert.
2195
HTTPS 443 gateway.push.apple.com
(17.0.0.0/8)
HTTPS
HTTPS
HTTPS
HTTPS
HTTPS
443
443
443
443
443
Comment
Google APIs for Android enterprise
Apple Push Notification service
Optional?
Yes vpp.itunes.apple.com
(17.0.0.0/8) itunes.apple.com (17.0.0.0/8)
Apple Volume Purchase
Program
Apple App identifier search
Yes deviceservicesexternal.apple.com (17.0.0.0/8)
Apple Activation Lock Bypass for supervised devices
Yes mdmenrollment.apple.com
(17.0.0.0/8)
Apple Device Enrollment
Program
Yes login.live.com
*.notify.windows.com
login.microsoftonline.com
graph.microsoft.com
Windows Push Notification service
Microsoft Intune app protection
Yes
From the Sophos Mobile server to the following internal hosts
Destination Protocol
MS SQL
MySQL
SMTP
Port
1433
3306
25
SMTP SSL 465
SMTP TLS 587
LDAP
LDAPS
HTTPS
HTTPS
389
636
443
443
<your database host>
<your SMTP host>
<your LDAP host>
Comment
If not on same computer as
Sophos Mobile
Mails for enrollment and maintenance
To your directory server
<your Exchange server> For ActiveSync traffic
<your SGN server> For SGN integration
Optional?
Yes
Yes
Yes
10 Copyright © 2018 Sophos Limited
Sophos Mobile on Premise
From the devices to the Internet
For the managed devices, while connected to the WLAN, the following ports to the Internet should be open.
Service
APNs
HTTPS
GCM
HTTPS
Port
5223
443
Destination
17.0.0.0/8
5228-5230 Internet
(all IP blocks listed in Google’s
ASN of 15169)
443 mesu.apple.com
*.notify.windows.com
*.wns.windows.com
*.notify.live.net
Comment
Apple Push Notification service for iOS and macOS devices.
Optional?
Apple service for available iOS and macOS updates.
Google Cloud Messaging (GCM) for Android devices.
GCM typically only uses port
5228, but it sometimes uses
5229 and 5230.
Yes
1
Windows Notification Service
(WNS) and Microsoft Push
Notification Service (MPNS) for
Windows devices.
Between Sophos Mobile server nodes
Protocol Port
TCP
TCP
UDP
7600, 8181, 57600
7600, 8181, 57600
45700
Destination
<incoming>
<outgoing>
<incoming>
Comment Optional?
1 If not available, Sophos Mobile has no information about iOS and macOS updates. For example, compliance rules regarding mandatory updates have no effect.
Copyright © 2018 Sophos Limited 11