Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 22 replies
  • Answers 2 answers
  • Subscribers 31 subscribers
  • Views 17453 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cisco Webex and Decrypt & scan HTTPS issue

SPY3

Hi

 

I am trying to get audio to connect within a Cisco webex meeting.

 

If i disabled Decrypt & scan HTTPS or add my IP to exceptions the audio connects fine.

I have exceptions for each domain listed on https://help.webex.com/en-us/WBX264/Network-Requirements

They are all added in the following format

Looking through the web filter logs I do not see any other domains while trying to connect to the audio. So it appears they are all covered.

 

Is there any other reason the XG keeps putting itself between the PC and Cisco when doing the audio connections? Not sure were else to look on the XG for what is triggering this.



This thread was automatically locked due to age.
  • 0 in reply to rfcat_vk

    None of that.

     

    I am going to https://www.webex.com/test-meeting.html and joining the meeting

    Once I have joined I go to connect the audio for my PC speakers/mic. It will sit there and fail/stop.

     

  • 0 in reply to SPY3

    So what does the log show during this setup?

    There is a lot of traffic going to many sites.

    Ian

  • 0 in reply to rfcat_vk

    It matches that log. If I turn off https scanning it will work straight away.

    Rule 18, the one you asked me to make. I had HTTPS scanning off for the log. Soon as I turn https scanning on it doesn't work.

  • +1 in reply to SPY3

    Hi,

    the application does not appear to work with proxies which is what https scanning does.

    Basically you will need a rule that allows webex to not use http/s scanning. Do your users always go the same sites for webex conferences, if so you can build a specific rule to all http and https to access those sites only. I don't think creating an exception will work because it is still going through the proxy just not being scanned.

     

    Quote from Cisco webex site.

    "Architecture

    Firewall Friendly

    Work through most firewalls using standard HTTP and HTTPS ports."

     

    Ian

  • 0 in reply to rfcat_vk

    So maybe make a rule with destinations similar to the domains I have in my exception list you think?

  • 0
    You can effectively make an exception at the firewall level, setting certain destination FQDNS (which map to IPs) to not go through the proxy.
    You can also make an exception within the web proxy, which is what you've been trying to do.
     
    We have seen applications in the past which do the following:
    Attempt to connect to site 1 - cannot resolve DNS
    Attempt to connect to site 2 - resolve DNS, SSL handshake, HTTPS
     
    When you insert the XG, what happens is that when it tries to connect to site 1, the XG does HTTPS decryption in order to show a friendly error message.  This confuses the application and it won't try to connect to site 2.  Whether it is a DNS error or some other failure, the point is that the XG does HTTPS decryption even if you have an exception, in order to show certain errors.
     
    Try going to Web, General Settings, and select "Drop connection without a user notification".
     
    If that does not fix it, try turning off pharming protection.  We know of at least one application use hardcoded resolution and does not like the XG re-resolving the IP.
     
    If that is still not good, I would run wireshark on the PC and watch the traffic to try to determine what exactly it is failing on.
  • 0 in reply to rfcat_vk

    Hi,

    I created a rule on top but I am still unable to start audio on Webex meetings. It works only if I disable https decrypt.

     

    Any other suggestings?

     

    Best regards,

    Alessandro

  • 0 in reply to alessandro scuderi

    when testing the rule you made there I used any port not just http/https

  • 0 in reply to SPY3

    Tried but nothing has changed.