Sophos Endpoint Security and Control
4 How does your SEC Server manage its clients
This section explains the various network components to enable communications between the
SEC Server and the customers' managed endpoints.
The diagram below shows how the various servers, domains, ports, internal and external IP addresses interact. The IP addresses shown are examples and should be replaced with actual
IP addresses.
8
The SEC Server is addressed both internally and externally by the same domain name, sophos-console.msp.com. We assume that the virtual directory website uses port 80 for inbound connections.
In the example shown, the edge device has an IP address 1.1.1.1, which is the external interface of the firewall. Ports 80, 8192, and 8194 are translated with NAT through this interface.
If you plan to use Sophos Patch, you must configure the reverse proxy on the edge device so it redirects the traffic that matches the address http://<1.1.1.1>/Sophos/Management/Patch/EndpointCommunicator/ to the SEC Server.
We recommend you use a transparent caching proxy on the customer's location to reduce traffic used by patch and endpoint updates.
4.1 Network requirements
All machines, including the SEC server, should be able to resolve the fully qualified domain name
(FQDN) appropriately. If your server is using a private IP (RFC 1918) and is publically reached using NAT, this would mean that sophos-console.msp.com would resolve to the SEC Server's
Managed Service Provider guide for a single server internal IP address (e.g. 192.168.0.2). For remote machines, the FQDN would resolve to your
SEC Server's external IP address (e.g 1.1.1.1).
1. Create a DNS A record called sophos-console.msp.com for BOTH internal and external DNS systems as follows: a) Create an internal address record that resolves to the internal IP address of the SEC Server
(e.g. 192.168.0.2).
b) Create an external (Internet) DNS A record that resolves to the public interface of the SEC
Server (e.g. 1.1.1.1).
2. Configure the SEC Server's Internet firewall to port-forward (with NAT if necessary) TCP ports
8192 and 8194.
9
