Cisco Webex Audio not working

Hi Scott1 

Could you please check the DOS status and DOS setting for the UDP flood?

To bypass DOS - https://docs.sophos.com/nsg/sophos-firewall/v16058/Help/en-us/webhelp/onlinehelp/index.html#page/onlinehelp/DoSBypassRuleEdit.html

Hi Keyur, do you mean this?

Do we have any other suggestions?  I'm still not able to get this working unfortunately. 

Check the web filter log, it's more useful than the firewall log. If I remember correctly webex uses IP addresses for some of its content, if you block the IP Address category then that would explain this. If you don't still check the log file while you fire up the application then allow anything you see blocked till you find the one it requires.

Regards

Try to open port 9000/udp.

Hi Scott1 

Could you please create a source IP base firewall rule for testing purposes in LAN to WAN and allow everything for that specific IP, move the rule on top.

Apply scanning and policies one by one and observe that after which parameter is not getting connected.

Hi Scott1 

If LAN to WAN firewall rule has been configured with Web filtering, I would suggest you to review this KB Article : Sophos XG Firewall: Webex not working when used with web proxy

Thanks,

Hi together,

I tested it with v18 MR1 and got it to work with with 443/tcp and 9000/udp open, using DPI instead of Web Proxy and ATP completely switched off. (It is not sufficient to add a exception in ATP. It really needs to be off. Afterwards the appliance needs a reboot.)

Best Regards

Dom

Update:

It‘s not working anymore since the last Webex app update both on macOS and iOS.

Hi Dom Nik 

Did you check with other OS?

What if you create a plain firewall rule for those specific OS IP address?

Hi together,

we debugged it together with Sophos in a live session and finally got a working solution. :-) (NC-59268)

These are my settings and it's working like a charm:

- https scanning using IPS is fully active, no exceptions for Webex.

- Ports in addition to 443/https:

- The following setting does the trick as of v18 MR1 (there was a change with MR1 making the setting necessary - it seems to be implicitly active in previous releases):

set http_proxy relay_invalid_http_traffic on

- No more configuration or https-scan exceptions needed and audio/video seems to work through UDP ports with better performance/latency than fallback solutions using 443/tcp.

Hope this helps!

Thanks to Rana Sharma, -pete-, Elardus, Apurv Patel, deepti.bhavsar and Tim. (hope I did not forget someone).

Best Regards

Dom

Can you share the entire firewall role you setup for this. I am still having trouble and must be missing something.

Thanks

Can you share the entire firewall role you setup for this. I am still having trouble and must be missing something.

Thanks