SSL Inspection and WebEX

Webex does not use SNI, instead they connect to a domain. 

See: https://community.sophos.com/sophos-xg-firewall/f/discussions/111890/cisco-webex-and-decrypt-scan-https-issue

Hello LuCar,

I had already an older exception list for WebEx Traffic implemented. I’m unsure if this is the correct syntax:

I didn’t find a hint in the Documentation for the correct syntax for network definitions. Or is it the same as on UTM that I have to write CDIR networks as regex?

Ben

Hello LuCar,

I had already an older exception list for WebEx Traffic implemented. I’m unsure if this is the correct syntax:

I didn’t find a hint in the Documentation for the correct syntax for network definitions. Or is it the same as on UTM that I have to write CDIR networks as regex?

Ben

you need some URLs as well

also your IP range list seems incomplete, maybe mine is already, too. Things change so fast.

https://help.webex.com/en-us/WBX264/How-Do-I-Allow-Webex-Meetings-Traffic-on-My-Network

check the expandable buttons on the bottom of that page...

also FW rules needed.

My working setup is a little bit different. I used the IPs, Ports, and URLs as described here: 

https://help.webex.com/en-us/WBX264/How-Do-I-Allow-Webex-Meetings-Traffic-on-My-Network

1. I created a URL Group 

2. I used this group for a SSL/TLS Rule and use the action "Don't decrypt"
3. I created one Exception for the IPs and another for the URLs. If I combine both in one rule it does not work. 

4. I created a Firewall Rule with the destination to the IP Addresses and the URLs using port 5004/tcp and port 9000/udp