Unblock Sophos A/V autoupdate

[Stryker412]

Not sure when this started occurring but it looks like our Fortigate is now blocking Sophos A/V updates. Can anyone tell me what exceptions I need to add to allow the updates to take place?

[Dave_Hall]

Create an app control sensor or add a new entry to an existing one that is used in your general firewall policy for web traffic -- add a new entry for allowing Updates. Also see this link for a list of ports that need to be allowed through if you are still having blocking issues.

[Fullmoon]

How do you implem your enterprise sophos av?based on my previous case if sophos clients gets updates from SEC then I would create a firewall policy to Sophos server to grant full access to the internet (no security profiles enabled).

[AndreaSoliva]

Hi only to get another possibility which is not well known but sometimes useful. Let' s imagine you have a rule: internal to wan all any allow On this rule you have enabled webfilter, antivirus, dlp etc. This what has to be known is even in the webfilter a site like fortinet.com is allow it is not allways the case that the site is not blocked because of another utm feature like antivirus. what you can do is a URL Filter with a specific FQDN/domain and set the action to exempt. Under exempt you can define for example " set exempt av" which means if in a rule with webfilter, antivirus, dlp this site would be exempt from antivirus which means after going to the webfilter not forwarded to the antivirus fuction instead fully bypassed for the defined utm feature. to be configured as following: # config webfilter urlfilter # edit [Integer for existing Web Filter Profile example 1] # config entries # edit [Uese a Integer example 1] # set url [definie url like " fortinet.com" ] # set type [simple | regex | wildcard] # set action exempt # set exempt [ av | web-content | activex-java-cookie | dlp | fortiguard | range-block all] # set status enable # unset referrer-host # end # end If you set action to exempt the default for " set exempt" is following: set exempt av web-content activex-java-cookie dlp fortiguard range-block all In this way you can bypass from webfilter a utm action which is also defined in the same rule. Disadvantage of this configuration you see within the gui that the action is set to " Exempt" but you do not see what option is used for " set exempt" . Of course a new rule on the top for destination fortinet.com and not using a specific utm profile (which covers top down first match wins) would also cover the needs and is probably for some installations/configuration more transparent because " you can see the config ober gui and within the firewall policy" . hope this helps have fun Andrea