Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 22 replies
  • Answers 2 answers
  • Subscribers 31 subscribers
  • Views 17473 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cisco Webex and Decrypt & scan HTTPS issue

SPY3

Hi

 

I am trying to get audio to connect within a Cisco webex meeting.

 

If i disabled Decrypt & scan HTTPS or add my IP to exceptions the audio connects fine.

I have exceptions for each domain listed on https://help.webex.com/en-us/WBX264/Network-Requirements

They are all added in the following format

Looking through the web filter logs I do not see any other domains while trying to connect to the audio. So it appears they are all covered.

 

Is there any other reason the XG keeps putting itself between the PC and Cisco when doing the audio connections? Not sure were else to look on the XG for what is triggering this.



This thread was automatically locked due to age.
Parents
  • 0
    You can effectively make an exception at the firewall level, setting certain destination FQDNS (which map to IPs) to not go through the proxy.
    You can also make an exception within the web proxy, which is what you've been trying to do.
     
    We have seen applications in the past which do the following:
    Attempt to connect to site 1 - cannot resolve DNS
    Attempt to connect to site 2 - resolve DNS, SSL handshake, HTTPS
     
    When you insert the XG, what happens is that when it tries to connect to site 1, the XG does HTTPS decryption in order to show a friendly error message.  This confuses the application and it won't try to connect to site 2.  Whether it is a DNS error or some other failure, the point is that the XG does HTTPS decryption even if you have an exception, in order to show certain errors.
     
    Try going to Web, General Settings, and select "Drop connection without a user notification".
     
    If that does not fix it, try turning off pharming protection.  We know of at least one application use hardcoded resolution and does not like the XG re-resolving the IP.
     
    If that is still not good, I would run wireshark on the PC and watch the traffic to try to determine what exactly it is failing on.
Reply
  • 0
    You can effectively make an exception at the firewall level, setting certain destination FQDNS (which map to IPs) to not go through the proxy.
    You can also make an exception within the web proxy, which is what you've been trying to do.
     
    We have seen applications in the past which do the following:
    Attempt to connect to site 1 - cannot resolve DNS
    Attempt to connect to site 2 - resolve DNS, SSL handshake, HTTPS
     
    When you insert the XG, what happens is that when it tries to connect to site 1, the XG does HTTPS decryption in order to show a friendly error message.  This confuses the application and it won't try to connect to site 2.  Whether it is a DNS error or some other failure, the point is that the XG does HTTPS decryption even if you have an exception, in order to show certain errors.
     
    Try going to Web, General Settings, and select "Drop connection without a user notification".
     
    If that does not fix it, try turning off pharming protection.  We know of at least one application use hardcoded resolution and does not like the XG re-resolving the IP.
     
    If that is still not good, I would run wireshark on the PC and watch the traffic to try to determine what exactly it is failing on.
Children
No Data