Microsoft office 365 auto installer being blocked by Sophos XG125

Question

Hi 
 I have deployed sophos XG125 firewall and found that 
 1. office 365 autoinstaller is being blocked by the XG 
 2. The use a Citrix client to connect to a website and download some templates in .xlsx format. The file downloads but cannot open. The XG reports the website domain-virus under blocked web attempts (see snapshot) 
 
 Anyone with solution for office365 and the blocked web site? Note the file actually downloads but cannot open, gives an extension error. 
 Regards 
 Tim

Lonnie Thibodeaux · Accepted Answer

I put in the following exceptions, and was able to get the Office 365 to sucessfully complete: 
 ^([A-Za-z0-9.-]*\.)?microsoft\.com/ ^([A-Za-z0-9.-]*\.)?windowsupdate\.com/ ^([A-Za-z0-9.-]*\.)?officecdn.microsoft.com.edgesuite.net/ ^([A-Za-z0-9.-]*\.)?officecdn.microsoft\.com/ ^([A-Za-z0-9.-]*\.)?windows\.com/ 
 Initially I had just the officecdn.microsoft.com.edgesuite.net & officecde.microsoft.com urls in the exception. I had to add the other three to get it to work. 
 Hope this helps. 
 LThibx

FabioTerrone · Answer

Well I will reply to all similar discussion to help all. 
 I discovered that every new firmware upgrading, the manual exception to section WEB \ EXCEPTIONS \ Microsoft Windows Update are deleted ! 
 So first check that the exceptions that you have already inserted are deleted or not and after input again. 
 But to check also what Microsoft adds or changes as website from download Office 365. 
 Currently 15 may 2017, I discovered that microsoft use also this website: officecdn.microsoft.com.edgesuite.net (akamai provider). 
 So for me to have successfully update of Office 365 I need to add these excpetions: 
 officecdn.microsoft.com.edgesuite.net (new one manual added) 
 and 
 ^([A-Za-z0-9.-]*\.)?windows\.com/ (already manual added ) 
 The defualt reset expections after SFOS 16.05.4 MR-4 were only: 
 ^([A-Za-z0-9.-]*\.)?windowsupdate\.com/ 
 and 
 ^([A-Za-z0-9.-]*\.)?microsoft\.com/ 
 So check if you have ON Microsoft Windows Update and if you add the bold link.

OliverPlum · Answer

Hi Tim, 
 if i have understood you correctly. 
 Try to add officecdn.microsoft.com and officecdn.microsoft.com.edgesuite.net to your policy. 
 Hope that helps. 
 
 greetings, 
 Olli

Microsoft office 365 auto installer being blocked by Sophos XG125

Top Replies