Our Sophos Management Server is installed behind a Palo Alto firewall, which is used to centrally update and manage all internal Sophos clients.

Sophos_Mgmt_Console.png?resize=800%2C358&ssl=1Sophos_Mgmt_Console.png?resize=800%2C358&ssl=1

After new installation of this Sophos Management Server, we found update from Internet always failed. The Palo Alto firewall rule was configured to use FQDN addresses as destination. Based on Sophos support site,
“The Sophos Update Manager (SUM) server uses port 80 (http) and requires access to the following eight addresses:

  • dci.sophosupd.com
  • d1.sophosupd.com
  • d2.sophosupd.com
  • d3.sophosupd.com
  • dci.sophosupd.net
  • d1.sophosupd.net
  • d2.sophosupd.net
  • d3.sophosupd.net
“
Although all those eight ip addresses has been programed into Palo Alto firewall, unfortunately the firewall rule still does not work. Even we changed to any ip address in destination, there is still failed message.
Sophos_Update_error_logs.png?resize=800%2C488&ssl=1Sophos_Update_error_logs.png?resize=800%2C488&ssl=1 Sophos_Update_error.png?resize=800%2C426&ssl=1Sophos_Update_error.png?resize=800%2C426&ssl=1

Lets take a look Palo Alto firewall rule configured before:
Original_Configuration.png?resize=800%2C112&ssl=1Original_Configuration.png?resize=800%2C112&ssl=1
and Palo Alto logs:
Palo_Alto_Logs_detail.png?resize=800%2C506&ssl=1Palo_Alto_Logs_detail.png?resize=800%2C506&ssl=1 Palo_Alto_logs_threat.png?resize=800%2C449&ssl=1Palo_Alto_logs_threat.png?resize=800%2C449&ssl=1
We found Palo Alto firewall treated some network connections as a threat and denied the file downloading from Sophos Update site. 
Lets modify rule:
Modified_Configuration.png?resize=800%2C63&ssl=1Modified_Configuration.png?resize=800%2C63&ssl=1
Now the Sophos Update Manager looks much better:
downloading.png?resize=800%2C408&ssl=1downloading.png?resize=800%2C408&ssl=1 successful.png?resize=800%2C543&ssl=1successful.png?resize=800%2C543&ssl=1
Youtube Video: A Quick Look of Sophos Enterprise Console 5.5: