Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 1 reply
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 1093 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Teams QOS

PD_Pat

Dear All

I would like to activate QOS for Teams. So I have mad a rule in Sophos with DSCP Marking 46 for the ports "80,443,3478-3481_UDP" and as the destination networks i have put so far:
*.lync.com
*.teams.com
teams.microsoft.com

1. Is it allowed to use wildcards in the destination networks?


2. How can I add all the recommended networks easiest? (see ms list below)
As far as I understand I don't just need to add the IPs. I need to provide wohle networks with the subnet masks as well and I haven't found a way to do it, except doing it 1:1.

Here the official list from Microsoft:
Office 365 URLs and IP address ranges - Microsoft 365 Enterprise | Microsoft Learn

Or is there a smarter way to solve it?

Thanks



This thread was automatically locked due to age.
Parents
  • 0

    SFOS (v19, at least) has Traffic Shaping rules of several types, including Application rules, Firewall rules, User Rules, and something else I forget now. I use the Application-based rules rather than trying to add firewall-rule-based rules. Please search this forum for discussions of setting up Traffic Shaping, as there are multiple steps and places to go and it's easy to think you have it on when you do not.

    In particular -- and I think this is right -- you'd want to:

    1.Go to System Services > Traffic Shaping and make an Applications Shared Guarantee policy (three radio buttons) with the priority you want and the guarantee you want.

    2. Applications > Traffic shaping default and use the filter on Category to find names containing Teams. Edit the appropriate entries to have the traffic shaping policy you created in step 1.

    3, Go to Web > Policies and set up a policy. In my case, I took a policy that I was already using (which had a bunch of apps in a Deny section) and added a section with Allow which had my conferencing apps in it. These apps are the ones I added the policy to in step 2. The idea is that you want to allow them, of course, but given that they are explicitly allowed their traffic shaping policy can be applied.

    4. In the applicable Firewall rule that the traffic will end up going through (which other traffic will probably also go through, you don't have to make a rule just for Traffic Shaping), go down to the Other security features section and under App Control, apply your policy from step 3. And check the box Apply application-based traffic shaping policy.

    Maybe a step here is unnecessary, but it worked for me.

Reply
  • 0

    SFOS (v19, at least) has Traffic Shaping rules of several types, including Application rules, Firewall rules, User Rules, and something else I forget now. I use the Application-based rules rather than trying to add firewall-rule-based rules. Please search this forum for discussions of setting up Traffic Shaping, as there are multiple steps and places to go and it's easy to think you have it on when you do not.

    In particular -- and I think this is right -- you'd want to:

    1.Go to System Services > Traffic Shaping and make an Applications Shared Guarantee policy (three radio buttons) with the priority you want and the guarantee you want.

    2. Applications > Traffic shaping default and use the filter on Category to find names containing Teams. Edit the appropriate entries to have the traffic shaping policy you created in step 1.

    3, Go to Web > Policies and set up a policy. In my case, I took a policy that I was already using (which had a bunch of apps in a Deny section) and added a section with Allow which had my conferencing apps in it. These apps are the ones I added the policy to in step 2. The idea is that you want to allow them, of course, but given that they are explicitly allowed their traffic shaping policy can be applied.

    4. In the applicable Firewall rule that the traffic will end up going through (which other traffic will probably also go through, you don't have to make a rule just for Traffic Shaping), go down to the Other security features section and under App Control, apply your policy from step 3. And check the box Apply application-based traffic shaping policy.

    Maybe a step here is unnecessary, but it worked for me.

Children
No Data
Unfiltered HTML