Appliance requirements
The following requirements apply to all virtual machines (VMs) or hardware that use an integration appliance. Refer to individual product integration guides for other requirements specific to the product. See Sophos NDR.
Minimum system requirements
All platforms must have, at a minimum:
- 4 CPUs
- 16 GB RAM
- 160 GB storage
CPU requirements
For Sophos NDR, ensure the following CPU flags are set:
pdpe1gb: The packet capture technology needs this.avx2: The Sophos machine learning features need this.
Both flags are available in the Intel and AMD CPUs, as shown in the table below.
NDR can also run on VMs with more current CPUs, such as Intel Core i5, as long as they have the CPU flags set. Any CPU launched since Q1'15 should work.
The system running the VM must use one of the CPU microarchitectures shown below.
Intel CPUs
| Name | Generation | Codename | Date |
|---|---|---|---|
| Skylake | 6 | Skylake | Q3 2015 |
| Skylake | 7 | Kaby Lake | Q3 2016 |
| Skylake | 8 | Coffee Lake | Q3 2017 |
| Skylake | 9 | Coffee Lake Refresh | Q4 2018 |
| Skylake | 9 | Cascade Lake | Q2 2019 |
| Skylake | 10 | Comet Lake | Q3 2019 |
| Palm Cove | 10 | Cannon Lake | Q2 2018 |
| Sunny Cove | 10 | Ice Lake | Q3 2019 |
| Cypress Cove | 11 | Rocket Lake | Q1 2021 |
| Golden Cove | 12 | Alder Lake | Q4 2021 |
| Raptor Cove | 13 | Raptor Lake | Q4 2022 |
To help you identify CPUs, Intel's CPU naming conventions are shown below.
AMD CPUs
| Name | Generation | Codename | Date |
|---|---|---|---|
| Zen | 1 | Naples | Q2 2017 |
| Zen | 1 | Great Horned Owl | Q1 2018 |
| Zen 2 | 2 | Rome | Q3 2019 |
| Zen 3 | 3 | Milan | Q2 2021 |
| Zen 4 | 4 | Genoa | Q4 2022 |
To help you identify CPUs, AMD's CPU naming conventions are shown below.
Port and domain exclusions
Make sure the ports and domains below are allowed on your firewall. This lets the Sophos virtual appliance boot and download updates.
The domains you need to allow depend on whether your firewall supports wildcards.
Click the appropriate tab for details.
| Domain | Ports | Protocols |
|---|---|---|
| *.sophos.com | TCP/443, TCP/22 | HTTPS, SSH |
| *.amazonaws.com | TCP/443 | HTTPS |
| *.ubuntu.com | TCP/80, TCP/443, UDP/123 | HTTP, HTTPS, NTP |
| api.snapcraft.io | TCP/443 | HTTPS |
| auth.docker.io | TCP/443 | HTTPS |
| get.k3s.io | TCP/443 | HTTPS |
| github.com | TCP/443 | HTTPS |
| objects.githubusercontent.com | TCP/443 | HTTPS |
| packages.buildkite.com | TCP/443 | HTTPS |
| production.cloudflare.docker.com | TCP/443 | HTTPS |
| raw.githubusercontent.com | TCP/443 | HTTPS |
| registry-1.docker.io | TCP/443 | HTTPS |
| sophossecops.jfrog.io | TCP/443 | HTTPS |
| Domain | Port | Protocol |
|---|---|---|
| api.snapcraft.io | TCP/443 | HTTPS |
| archive.ubuntu.com | TCP/80 | HTTP |
| auth.docker.io | TCP/443 | HTTPS |
| central.sophos.com | TCP/443 | HTTPS |
| changelogs.ubuntu.com | TCP/443 | HTTPS |
| entropy.ubuntu.com | TCP/443 | HTTPS |
| get.k3s.io | TCP/443 | HTTPS |
| github.com | TCP/443 | HTTPS |
| jfrog-prod-use1-shared-virginia-main.s3.amazonaws.com | TCP/443 | HTTPS |
| ndr.apu.sophos.com | TCP/22 | SSH |
| nta-proxy.cloudstation.eu-central-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-proxy.cloudstation.eu-west-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-proxy.cloudstation.us-east-2.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-proxy.cloudstation.us-west-2.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-proxy.cloudstation.ca-central-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-proxy.cloudstation.ap-northeast-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-proxy.cloudstation.ap-southeast-2.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-proxy.cloudstation.ap-south-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-proxy.cloudstation.sa-east-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-push-ws.cloudstation.eu-central-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-push-ws.cloudstation.eu-west-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-push-ws.cloudstation.us-east-2.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-push-ws.cloudstation.us-west-2.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-push-ws.cloudstation.ca-central-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-push-ws.cloudstation.ap-northeast-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-push-ws.cloudstation.ap-southeast-2.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-push-ws.cloudstation.ap-south-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| nta-push-ws.cloudstation.sa-east-1.prod.hydra.sophos.com | TCP/443 | HTTPS |
| ntp.ubuntu.com | UDP/123 | NTP |
| objects.githubusercontent.com | TCP/443 | HTTPS |
| packages.buildkite.com | TCP/443 | HTTPS |
| production.cloudflare.docker.com | TCP/443 | HTTPS |
| raw.githubusercontent.com | TCP/443 | HTTPS |
| registry-1.docker.io | TCP/443 | HTTPS |
| s3-r-w.eu-west-1.amazonaws.com | TCP/443 | HTTPS |
| s3-r-w.eu-central-1.amazonaws.com | TCP/443 | HTTPS |
| s3-r-w.us-east-2.amazonaws.com | TCP/443 | HTTPS |
| s3-r-w.us-west-2.amazonaws.com | TCP/443 | HTTPS |
| s3-r-w.ca-central-1.amazonaws.com | TCP/443 | HTTPS |
| s3-r-w.ap-southeast-2.amazonaws.com | TCP/443 | HTTPS |
| s3-r-w.ap-northeast-1.amazonaws.com | TCP/443 | HTTPS |
| s3-r-w.ap-south-1.amazonaws.com | TCP/443 | HTTPS |
| s3-r-w.sa-east-1.amazonaws.com | TCP/443 | HTTPS |
| sdu-feedback.sophos.com | TCP/443 | HTTPS |
| security.ubuntu.com | TCP/80 | HTTP |
| sophossecops.jfrog.io | TCP/443 | HTTPS |
| tf-nta-sva-images-cloudstation-eu-west-1-prod-bucket.s3.eu-west-1.amazonaws.com | TCP/443 | HTTPS |
| tf-nta-sva-images-cloudstation-eu-central-1-prod-bucket.s3.eu-central-1.amazonaws.com | TCP/443 | HTTPS |
| tf-nta-sva-images-cloudstation-us-east-2-prod-bucket.s3.us-east-2.amazonaws.com | TCP/443 | HTTPS |
| tf-nta-sva-images-cloudstation-us-west-2-prod-bucket.s3.us-west-2.amazonaws.com | TCP/443 | HTTPS |
| tf-nta-sva-images-cloudstation-ca-central-1-prod-bucket.s3.ca-central-1.amazonaws.com | TCP/443 | HTTPS |
| tf-nta-sva-images-cloudstation-ap-southeast-2-prod-bucket.s3.ap-southeast-2.amazonaws.com | TCP/443 | HTTPS |
| tf-nta-sva-images-cloudstation-ap-northeast-1-prod-bucket.s3.ap-northeast-1.amazonaws.com | TCP/443 | HTTPS |
| tf-nta-sva-images-cloudstation-ap-south-1-prod-bucket.s3.ap-south-1.amazonaws.com | TCP/443 | HTTPS |
| tf-nta-sva-images-cloudstation-sa-east-1-prod-bucket.s3.sa-east-1.amazonaws.com | TCP/443 | HTTPS |
| tf-presigned-url-eu-west-1-prod-ndr-bucket.s3.eu-west-1.amazonaws.com | TCP/443 | HTTPS |
| tf-presigned-url-eu-central-1-prod-ndr-bucket.s3.eu-central-1.amazonaws.com | TCP/443 | HTTPS |
| tf-presigned-url-us-east-2-prod-ndr-bucket.s3.us-east-2.amazonaws.com | TCP/443 | HTTPS |
| tf-presigned-url-us-west-2-prod-ndr-bucket.s3.us-west-2.amazonaws.com | TCP/443 | HTTPS |
| tf-presigned-url-ca-central-1-prod-ndr-bucket.s3.ca-central-1.amazonaws.com | TCP/443 | HTTPS |
| tf-presigned-url-ap-southeast-2-prod-ndr-bucket.s3.ap-southeast-2.amazonaws.com | TCP/443 | HTTPS |
| tf-presigned-url-ap-northeast-1-prod-ndr-bucket.s3.ap-northeast-1.amazonaws.com | TCP/443 | HTTPS |
| tf-presigned-url-ap-south-1-prod-ndr-bucket.s3.ap-south-1.amazonaws.com | TCP/443 | HTTPS |
| tf-presigned-url-sa-east-1-prod-ndr-bucket.s3.sa-east-1.amazonaws.com | TCP/443 | HTTPS |

