Skip to content

Sophos Firewall (XGS / SFOS)

This guide covers the SFOS-specific steps needed to allow the RTA's outbound OpenVPN connection to connect.remotetesting.secureworks.com on TCP/443.

Note

For the full background (what the RTA connects to, why an ordinary "allow outbound 443" rule is not enough, and the two failure modes: TLS/SSL decryption and application control), see the firewall troubleshooting overview.

Activation-mode platforms also need get.remotetesting.secureworks.com

Appliances deployed from a generic image (AWS, GCP, Azure, Hyper-V on Windows 11) register and activate over a second outbound connection: standard HTTPS on TCP/443 to get.remotetesting.secureworks.com. When you add the decryption exception and application rule for connect.remotetesting.secureworks.com, also allow this destination and exempt it from TLS/SSL decryption (the appliance does not trust an intercepting proxy's re-signed certificate). Its IP addresses are not guaranteed to stay constant, so allowlist it by FQDN, not by IP. Pre-registered appliances (vSphere, VMware Workstation, VirtualBox, Nutanix, Hyper-V Server) do not use this endpoint.

Choose how to apply the fix

  • GUI (web admin)

    Create the FQDN host, TLS inspection exclusion, application control exception, and firewall rule in the SFOS web admin console.

  • CLI (XML API)

    Apply the same configuration from a terminal by posting XML payloads to the SFOS XML API with curl.

  • AI assistant (LLM)

    A copy-paste prompt that has your AI assistant walk you through the web admin configuration, pausing for your confirmation before anything is applied.