Sophos Endpoint Security and Control
If you plan to use Sophos Patch, you must configure the reverse proxy on the edge device so it redirects the traffic that matches the address http://<1.1.1.1>/Sophos/Management/Patch/EndpointCommunicator/ directly to the SEC Server.
We recommend you use a transparent caching proxy on the customer's location to reduce traffic used by patch and endpoint updates.
Note: Alternative ports can be used if necessary, for example if another application is already using port 80. When configuring client updating, the location should be specified in the standard manner. For example, if port 8085 is to be used, the update location should be http://sophos-dmz.msp.com:8085/sophos.
4.1 Network requirements
All machines, including the SEC server, should be able to resolve the fully qualified domain name
(FQDN) appropriately. If your server is using a private IP (RFC 1918) and is publically reached using NAT, this would mean that sophos-dmz.msp.com would resolve to the Sophos DMZ Server's internal IP address (e.g. 192.168.0.2). For remote machines, the FQDN would resolve to your
Sophos DMZ Server's external IP address (e.g 1.1.1.1).
1. Create a DNS A record called sophos-dmz.msp.com for BOTH internal and external DNS systems as follows: a) Create an internal address record that resolves to the internal IP address of the Sophos
DMZ Server (e.g. 192.168.0.11).
b) Create an external (Internet) DNS A record that resolves to the public interface of the
Sophos DMZ Server (e.g. 1.1.1.1).
2. Configure the Sophos DMZ Server Internet firewall to port-forward (with NAT) ports TCP 8192 and 8194.
10
