Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 679 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

False Positives

FAAC Inc

Hello, we are having some trouble with Zoom meetings where the sound is briefly dropping at times.  Sometimes we get the network quality message.

I may have traced the problem to some of the meeting traffic getting flagged as Proxy and Tunnel (x-vpn and freegate proxy) when it's incoming, and P2P Torrent Clients P2P when it's outgoing.  Both are getting blocked by the application filter.  IPS is currently disabled while we troubleshoot this.

Here's an example of the application log:

198.251.234.154 appears to be a Zoom IP, but it's not listed in the zoom exception list.  That might be due to this being a training session, so maybe they have some separate or dedicated IP's for that?

Here's some traffic from the firewall log:

Here are the ports I've allowed in my first firewall rule:

For the duration of the training, I'm going to allow VPN and torrent traffic through the application filter, but I'd like to find a better alternative to that. 



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Vivek Jagad

    Thanks Vivek, that was one of the first things I found and tried.

    As of yesterday, the people experiencing the problems have reported that it's better but still happens at times for a few minutes, then stops.  

    Another site has the same firewall, firewall settings, network switches, and the same ISP and is not experiencing the problems.  So now I'm not sure it's a firewall issue at all.  I have monitoring setup on our switches to measure traffic and while there are some spikes in traffic that matches when meetings are going on, there are just as many instances of the audio problem when traffic is very low.  

  • 0 in reply to FAAC Inc

    Can you validate whether the ISP is dropping the VoIP services traffic with the ISP Team ?
    Or if you have another ISP configured on the same FW, you can try routing from another ISP and can validate the difference in the audio ?

    Thanks & Regards,
    _______________________________________________________________

    Vivek Jagad | Team Lead, Global Support & Services 


    Sophos Community | Product Documentation | Sophos Techvids | SMS
    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Vivek Jagad

    We don't yet have a backup internet service we can cut over to, but are working on it.

    I was also informed this morning that some people have reported the same issue happening with our desk phones, which use a different firewall for their SIP trunks to our VoIP provider.

    Given that, I've opened a ticket with them to try to resolve this.  I believe we have taken this as far as we can as far as the Sophos is concerned.  

    Thanks for your Help Vivek.  Do you have a way you want me to close this thread out?

Unfiltered HTML