topic Re: Domain Object in Firewall and Security Management

Domain Object

handiansudianto — Fri, 10 Nov 2023 00:43:38 GMT

Hello,

I need to grant access all server to sophos update, i can see when sophos do the update the endpoint will connect to several url under main domain sophosupd.com (sdds3.sophosupd.com, sus.sophosupd.com)

For this i need suggestion if i need to make a domain object with .sophosupd.com and for the FQDN checkmark should be enable or disable?

Re: Domain Object

Chris_Atkinson — Fri, 10 Nov 2023 12:24:49 GMT

In general you should avoid using non-FQDN objects where possible.

Have you already tried the Sophos-update application object or is Application Control not enabled in your environment?

Re: Domain Object

handiansudianto — Fri, 10 Nov 2023 02:09:51 GMT

Hi @Chris_Atkinson

I have an application rule to allow all services and application from server subnet but also i have network policy to block server subnet to the internet. The network rule is needed to block server accessing to the internet by default.

With both of rules with drop on network but accept on the application, the server can't access to the any whitelisted application on the application rule. Any suggestion?

Re: Domain Object

Chris_Atkinson — Mon, 13 Nov 2023 08:18:17 GMT

For context how many sub-domains are you needing to handle?

With ordered layers the traffic must match (accept) on both layers to be allowed.