On the Endpoint Protection > Web Control > Global tab you can enable or disable endpoint web control if it was enabled before the upgrade to version 9.7. All configurations have been kept but you can’t change most of the settings anymore.

Parent Proxy

If your Sophos UTM does not have direct HTTP internet access, Endpoint Protection can use a proxy server to reach Sophos LiveConnect. Select Use a parent proxy and enter the host and port if necessary.