zoom application restart in firewall network. works better in non-firewall network

Hi Mahesh and welcome to the Sophos Community!

You posted in the UTM Community, so I moved this thread to the Sophos Firewall (XG) Community.

Cheers - Bob

Hello Sophos User6508,

Thank you for reaching out to the community, how many number of users were live when the issue occurred ?
Is DoS Protection enabled ? Have you enabled the flooding on the UDP protocol ?
What is the current firmware on the appliance ?

Hi,

this all I use for zoom meetings = a web exception with all boxes ticked

^([A-Za-z0-9.-]*\.)?zoom\.us/

Ian

zoom requires special ports to be open outbound, not only 443. But  this should have been migrated by your config restore. Did it work before? Maybe you need to adopt recent changes in the zoom ip ranges to your FW rules. support.zoom.us/.../201362683-Zoom-network-firewall-or-proxy-server-settings

Correct, I forgot to include this, my services entry for zoom,

TCP (1:65535) / (8801:8802), UDP (1:65535) / (3478:3479), UDP (1:65535) / (8801:8802)

Ian

yes it is there,

Yes, it was working very well from last one year. due to unknown reason my firewall restore to factory default settings. Upon restore from backup we are facing hell of zoom problems. Lat year we got some web exception file with tag required, minimum, full. these files are uploadble to firewall directly and create lot of web exceptions whihc we can switch on and off as per our need. BUt this time these files are not available any where on the net. If you are using office 365 - web exception files are available for office 365 on sophos database.

Yes, DoS protection and UDP Flooding is enable. current firmware is SFOS 18.5.4 MR-4-Build418

zoom is our main conferencing app so we have some experience with it.

you need to check IPS / UDP flood also. Also if there are other firewalls involved upstream. Zoom hates flood protection - their audio and video is UDP and has high rates of packets. Turn it off for UDP (1:65535) / (3478:3479), UDP (1:65535) / (8801:8802) - either to any or to the Zoom IP ranges only. Remember, you need also flood exceptions for inbound packets from thise zoom networks, not only outgoing.

Also we were never lucky with web exceptions only.

Our Zoom firewall rule exists of over hundred destination network objects. Of course you could allow those ports to any destination - but this is a little bit more insecure.

TLS and Webfiltering: off