Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 678 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

False Positives

FAAC Inc

Hello, we are having some trouble with Zoom meetings where the sound is briefly dropping at times.  Sometimes we get the network quality message.

I may have traced the problem to some of the meeting traffic getting flagged as Proxy and Tunnel (x-vpn and freegate proxy) when it's incoming, and P2P Torrent Clients P2P when it's outgoing.  Both are getting blocked by the application filter.  IPS is currently disabled while we troubleshoot this.

Here's an example of the application log:

198.251.234.154 appears to be a Zoom IP, but it's not listed in the zoom exception list.  That might be due to this being a training session, so maybe they have some separate or dedicated IP's for that?

Here's some traffic from the firewall log:

Here are the ports I've allowed in my first firewall rule:

For the duration of the training, I'm going to allow VPN and torrent traffic through the application filter, but I'd like to find a better alternative to that. 



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Vivek Jagad

    We don't yet have a backup internet service we can cut over to, but are working on it.

    I was also informed this morning that some people have reported the same issue happening with our desk phones, which use a different firewall for their SIP trunks to our VoIP provider.

    Given that, I've opened a ticket with them to try to resolve this.  I believe we have taken this as far as we can as far as the Sophos is concerned.  

    Thanks for your Help Vivek.  Do you have a way you want me to close this thread out?

Unfiltered HTML