anybody seeing issues with XG17 causing Outlook desktop client losing "sync" with Office365.

We are having the exact same issue since implementing a XG firewall.  I have added all of the domains listed on Microsoft's website that should be white-listed for office 365 connectivity and we are still having issues.  I also created a firewall rule for traffic to Office 365 service to not to any http or https scanning.  

Does anyone have any idea what is going on?  

It started working after putting ATP off.

For the most part it did. We still have random issues where we need to restart outlook to get it it working again. Most of our users have laptops and are docking and undocking several times a day. I don't know if that is part of our legacy issues where outlook does not like switching network connections. The issue did get significantly better after we created the O365 rules and turned off the scanning.

Do you have load balancing enabled for that rule?

I do not have load balancing enabled.  Just a fail over rule.  

Attached is the log of the IP of an effected machine narrowed down by denied traffic on Port 443.  Any ideas what "Could not associate packets to any connection" means?  Googling it gives me some pretty unhelpful information.  There is also no destination interface on JUST the denied traffic.   

What does your rule look like that routes all the office domains through your non-http-scanning rule?

I've still been working on this issue and for me it seems to be the connection between the Sophos firewall and my upstream Velocloud device.  if I try to ping the Velocloud through the Sophos, I get random ping delays.  I'll see 5-10 <1ms replies, then a 1ms reply and then a 8ms reply, and then it goes back down to <1 for 5-10 replies.  I've messed with the link settings, changing it from AUTO to 100Full  on the Sophons and that helped the ping responses and I seemed to lose sync less often.

I noticed that the Velocloud was reporting that it was running at 100 Half-duplex.  I tried settng everything to forced 1000Full and the worse ping times are back and the sync issue is worse.

I've added in additional switches between the Sophos and Velocloud and it does change how the pings look, which makes no sense to me.  but I can see that the worse the ping response is, the worse the sync issue gets.

Below is my firewall rule for traffic associated with the domains in this list: https://support.office.com/en-us/article/office-365-urls-and-ip-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2#bkmk_eop

As you can see I have everything off.  I can see there is a lot traffic in the log that is still denied with "Could not associate packet to any connection".  Maybe that's normal? 

Starting to wonder if it is something with Sophos Endpoint Protection, but the logs on that show nothing about blocking anything Microsoft related. 

In my long but highly undistinguished career I have seen now and then when 2 devices just dont want to auto sense correctly. Then you either force it on both sides or put a friendlier device in between them.

what all do you have in MS services. I have any all all domains related to 0365 in my rule. Not just the MS services rule.

The "Microsoft Services" Network list you see in the screen shot is a collection of all the required domains that Microsoft lists as being needed for everything related to office 365 to work.  I even added the domains for services we don't use.   

We also had issues with the office streaming install failing at 51%. So I put every last possible MS related domain in our rule.

We also had issues with the office streaming install failing at 51%. So I put every last possible MS related domain in our rule.

I was finally able to get the install going that way as well.  Still just had a user this morning that had to restart outlook to get her emails to show up.  I am going to contact Sophos support today and will report back.  

Hi All,

We are seeing quite a few sites with this exact issue & so far no luck with Sophos Support. Any one manage to find a solution which enables Outlook to Sync reliably?

Cheers

Hello Adam,

The case has not been pulled by our GES team yet.
I think you can close and open Outlook, as the problem can be reproduced.

################################################################
Here is details about case escalted to GES
################################################################

Your case requires additional assistance from our global escalation specialists (GES). GES engineers are the highest technical tier within support and are responsible for interacting with our development teams. A GES engineer will review your case and provide the necessary expertise necessary for resolution.

If the GES engineer requires further information, he/she may contact you directly.

Based on the case priority and complexity, he/she will contact you with their initial analysis within a maximum of 3 business days.

Often, GES will be able to provide a quick solution to the Level 2 Support engineer who will provide it to you. Otherwise, GES will take ownership of the case and work directly with you.

If GES identifies a product defect or needs further assistance, the Development Team will be engaged. For tracking and consistency in response, these engagements are all recorded and you will be provided the tracking number.

During regular meetings between GES and our Development Teams, all related open cases are discussed and an investigation timeline is agreed upon based on the priority of the defect. We consider both the technical severity of the problem and incident frequency in determining the priority of a defect. Please keep in mind that these meetings are held weekly for non-critical issues and therefore you may not receive an update for several days. Upon completion of the investigation, the Development Team will determine when the issue will be resolved. GES will communicate the plan to you. Once the fix has been released, you will be notified.

If either our response times or the timelines that were provided do not meet your business requirements, please contact my manager, XXXXX (deleted by Admin).

Regards,

XXXXX (deleted by Admin)
Sophos Technical Support
https://www.sophos.com/en-us/support/contact-support.aspx

Support Knowledge Base: https://community.sophos.com/kb
Follow us on Twitter @SophosSupport
Sophos Community (discussion forums): https://community.sophos.com

SOPHOS - Security made simple

I spoke on the phone with Sophos on Tuesday.  They emailed me a big list of URLs with wild cards to add to the exceptions list.  I already had added basically the same ones but without the wild cards. There is about 150 of them.   

I don't have a lot of faith that it's going to help.  I haven't heard of any issues yet, but over the last month and a half that is has been an issue, it has been very sporadic.     

Would you mind sharing the list & how the wished for them to be applied eg: custom rule or exceptions etc?

We are seeing more & more of this across the board & so far no feed back from the Sophos GES / DEV teams so not really sure where to go from here. 

3733.OUTLOOK_URLS.txt.zip

This is the file they emailed me.  It's the same as the Microsoft list that some haven't linked to here on this forum, but with the proper syntax for the XG.  

That being said, it still doesn't work.  It happened to my computer again among other.  I also have all the setting shown in the post above this with the exceptions list and firewall rule.  Still having trouble.  Sophos reached back out to me, so we will see.  

Tonight i spoke with the GES Team (Global Escalation Support) & they reviewed the wireshark trace. At this stage they believe the XG is doing nothing more than forwarding the packets in one of our setups. (This was one site where we had most services eg: Web, IPS, AV, HTTPS scanning etc off)

However, despite nothing running, this site DOES suffer from the Outlook Sync issue. I have also shown them 2 other XG Setups which have different setups with various exceptions etc however again no success. They plan to take another look in a few days (public holiday here tomorrow).

Fingers crossed something is uncovered as its quite a frustrating position to be in.

Has anyone else made progress?

Hi Adam,

I have the same case as yours too, may I know if there is any update from GES Team regarding to this issue?