anybody seeing issues with XG17 causing Outlook desktop client losing "sync" with Office365.

XG has always caused some kind of connectivity issues with Office 356 and windows updates, Ive been waiting for Sophos to add a method to use XML files or web db's of URL's & IP CIDRs for firewall rules destinations.  I managed to import a list of URLs i created from an XML file from MS but its only a web filter category so its not ideal as its till hitting the web proxy.  We need to import CIDR's to create hosts / host groups / or using XML files from urls really so firewall rules can be used with these as destinations and then set the filters & AV to none.

MS are updating the list of urls & ips all the time so best way would be to be pull from a web db.

JK

May I ask how you were able to import the XML file? I am trying to import an XML of web exceptions but i keep getting an error stating that it only accepts .TAR files even though the file i am trying to import is a .tar.  I have exported and tried editing directly in 7zip but that doesn`t work either. 

It worked.  Finally i must have had something incorrect in my original XML file

Let me know if Web filter exceptions works for you then, it didnt for me.  Only thing that helped was FW rule with no filtering at all as i mentioned.

Anyway be interested to know,

Now you know your way around the API try for FQDN hosts and let me know if it works.

JK

I have a couple of troubled users in my network so i should know by the end of the day.  I will keep you posted.  I also have the firewall rule setup and that didn`t work.  I am hopeful that these exceptions work. 

But did your Rule have all the FQDNs / URLs as the Destinations though???  

Hi All

Below is an extract of what i received from GES 

Office 365 traffic is legitimate traffic for that generally it is safe to bypass that traffic from AV scanning done on XG firewall.
With AV scanning applied on the firewall rule than in that case it is possible that outlook server will not be able to validate XG firewall's SSL certificate in that case we recommend to add exception for office 365 domains.

To bypass office 365 traffic from AV scanning we generally recommend to create LAN to WAN destination based plain FQDN rule for domains on which outlook client is making connection. This should be in the top position with no scanning applied, no policy applied except NAT policy default.(i.e. MASQ), source- any, service -any, destination- FQDN host group.

API feature available in XG firewall to create FQDN host and FQDN host group for office 365 domain.

1) refer below API query to create multiple FQDN host with single API query. here you can add <FQDNHost></FQNDHost> tag as mention below for remaining o365 domains before </Set> tag.

https://<Sophos IP>:<port>/webconsole/APIController?reqxml=<Request><Login><UserName>admin</UserName><Password>admin</Password></Login>
<Set Operation="add">
<FQDNHost><Name>*.aadrm.com</Name><FQDN>*.aadrm.com</FQDN></FQDNHost>
<FQDNHost><Name>*.activedirectory.windowsazure.com</Name><FQDN>*.activedirectory.windowsazure.com</FQDN></FQDNHost>
<FQDNHost><Name>*.adhybridhealth.azure.com</Name><FQDN>*.adhybridhealth.azure.com</FQDN></FQDNHost>
<FQDNHost><Name>*.azurerms.com</Name><FQDN>*.azurerms.com</FQDN></FQDNHost>
</Set>
</Request>

2) refer below API query to add those multiple FQDN hosts created in step 1) to one FQDN Hostgroup name (i.e. O365_domains)

https://<Sophos IP>:<port>/webconsole/APIController?reqxml=<Request><Login><UserName>admin</UserName><Password>admin</Password></Login>
<Set Operation="add">
<FQDNHostGroup>
<Name>O365_domains</Name>
<FQDNHostList>
<FQDNHost>*.aadrm.com</FQDNHost>
<FQDNHost>*.activedirectory.windowsazure.com</FQDNHost>
<FQDNHost>*.adhybridhealth.azure.com</FQDNHost>
</FQDNHostList>
</FQDNHostGroup>
</Set>
</Request>

3) Now you can use FQDN hostgroup O365_domains created in step 2) as destination in LAN to WAN plain firewall rule.

What they dont tell you is that there are challenges importing the FQDN Objects due to pure amount of them. (if you use the full MS List - which we are testing) You can overcome it using CURL.

Despite the result I am not convinced this is a real solution. Its a band-aid. The fact is MS will always be changing & its simply not practical to manually make these changes. 

great just what i been looking for!!! Your a star, Sophos support well web chat tech support agent said it couldnt be done.  I did tell him ive seen it before mentioned but i wasnt able to find the specifics.

anyway ill get on that now.

I have created a feature request for this problem of FQDN lists, we need a way to import FQDN lists from files and web dbs like we can with Web filter URLs.

Hopefully they will add this ASAP. as we both mentioned MS lists are always changing and recently they have changed the lists completely.  

https://techcommunity.microsoft.com/t5/Office-365-Blog/Announcing-Office-365-endpoint-categories-and-Office-365-IP/ba-p/177638

JK

I had a customer run into this issue.  The rule set did NOT have ANY filtering or scanning on it.  It was driving the customer nuts.  They are an HR outfit and they were missing critical employee emails because of the issue, which is not good when that is you reason for being in business is to answer those emails!  I went back and forth trying to trace down the issue to no avail.  They had a complete city block power outage that ran the UPSs out and shut down the Firewalls for about 5-10 minutes.  It came back up and everything is good now.  This is deeper than a exemption list.

Internally we had the MS Update issue that drive our engineer nuts for about 2 days until he finally figured out that it was FW issue.  He put in the exemptions for MS Updates and that did fix that issue.  And this was fixed in the last FW update.

So while it may seen to be the same issue, it is really two different issues.

Charles Johnson 

You can do mass imports/configurations with an XML through the API. With the XG API you can pass short parameters directly into the URL bar of your browser. For longer XML files like what we want to use here your best bet is to use the API with something like cURL or Python to pass the entire XML file. 

HERE is a link to a blog post which details the syntax for cURL and Python. The API is very quick and seems to work pretty well so far. I hope that helps. 

You have helped me a ton. I am still failing with using cURL.  I tried using postman and I guess my rookie skill set here is hindering me.  This is what i am getting back

COMPANY+it@IT-DIRECTOR MINGW64 ~
$ curl -k 10.1.70.1:4444/webconsole/APIController?-F C:\Users\blank\Des ktop\O_365_FQDN_HOST.xml
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (52) Empty reply from server
curl: (3) Port number ended with 'U'

You have helped me a ton. I am still failing with using cURL.  I tried using postman and I guess my rookie skill set here is hindering me.  This is what i am getting back

COMPANY+it@IT-DIRECTOR MINGW64 ~
$ curl -k 10.1.70.1:4444/webconsole/APIController?-F C:\Users\blank\Des ktop\O_365_FQDN_HOST.xml
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (52) Empty reply from server
curl: (3) Port number ended with 'U'

Not sure where the snag is here - Off the top of my head you should have a space on both sides of the '-F' flag.  Also - prefix the IP with https://. It Should be 

$ curl -k https://10.1.70.1:4444/webconsole/APIController? -F C:\Users\blank\Des ktop\O_365_FQDN_HOST.xml

That said I think I know what your trying to do. I actually just did the same thing yesterday and had some issues. If you are using the FQDN list that you found here there are some duplicates and issues with the format of the FQDNs which causes the API to reject the changes. 

I had to filter all the doubles out and a couple others. In total I think I pulled 6 out. 

Based on the traffic on these forums I am guessing that there are more than just you and I trying to get this done. I will try and get a tutorial posted today on my blog with a walk through and the full xml you need to add all Office 356 Hosts. I will post the link here when that is done. 

Also, I don't know how comfortable you are with Python, but if your on a windows machine may be easier to use that. If you have access to a Linux box I would use that for cURL before Windows. (That may just be my personal hatred for Windows coming out)

Charles Johnson 

Sorry, this weekend go away from me and I was not able to put the tutorial up yet. I will just post the XML I used here so you and others can have access to it. As I mentioned before, this is adapted from the Office365 zip file from Sophos support. I changed all domains to have the wild card '*', then wrapped them in xml tags. The other major difference was that I had to remove six domains from the list because they were causing the API to error out. 

These two attached files contain the XML to add all the domain objects from the O365 list (minus the six bad ones) then all those objects are added to a host group. 

First, send the FQDN_HOSTS.xml file to the API (Creates the objects)

Then, send the FQDN_GROUP.xml to the API (Assigns all objects to FQDN Group)

You can send me a private message if it is still not working and we can troubleshoot it further. 

7026.FQDN_HOSTS.xml0383.FQDN_GROUP.xml