Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 7 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 23863 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WebEx Audio

caldicot

Hallo,

 

I just encountered a problem when using WebEx with the Sophos XG Firewall.

I have a policy that allows all outgoing traffic from LAN to WAN and the intrusion prevention is set to "LAN to WAN".

 

I can connect to a WebEx meeting, but when I am joining the conference via PC, the audio is not working properly.

At the beginning the participants can hear me and I can hear them, but after a few seconds I cannot hear them and they cannot hear me.

So this behaviour is going on and on. It's always switching between dead communication and working communication.

 

I tried updated audio driver, changing headset ..., but I finally ended up disabling the Intrusion Prevention and then it seems to work.

I also added an Exception for web filtering (HTTPS Decryption, Malware Scanning, Sandstorm, Policy Checks), for the following matching domains:

^([A-Za-z0-9.-]*\.)?ciscowebex\.com\.?/
^([A-Za-z0-9.-]*\.)?omtrdc\.com\.?/
^([A-Za-z0-9.-]*\.)?webex\.com\.?/
^([A-Za-z0-9.-]*\.)?webexconnect\.com\.?/
 
This did not has any influence.
Can you please explain what exactly the intrusion prevention is trying to do and how can I disable it for only the WebEx meeting?
Or maybe there is another solution to solve this problem?
 
Thanks,
caldi
 


This thread was automatically locked due to age.
Parents
  • 0

    Caldi,

    if you are using LAN to WAN, while you are trying to have a webex, have a look at IPS logs on XG and see the IPS rule and Signature matched, so you can write down and remove it from LAN to WAN IPS rule.

    Regards

  • 0 in reply to lferrara

    Luk,

    thanks for your quick reply.

    I just saw a typo in my original post. The intrusion prevention was set to "WAN to LAN" in the policy that allows all outgoing traffic.

    I will activate this setting again and log the traffic with filter for ips.

    Just to avoid misunderstandings: adding an exception for the web filtering is the right action, but I have added the wrong urls to that exception?

    One additional question (maybe a little bit off topic):

    Would you recommend to enable the intrusion policy at all for the outgoing rule?

    Beside two VPN rules, there is only one further rule (business application rule) allowing some AWS server to connect to a MySQL Database within the LAN. For this rule the same intrusion prevention "WAN to LAN" is enabled.

    Thanks for your help

    Caldi

  • +1 in reply to caldicot

    Caldi,

    if the IPS is blocking the traffic, web exception will not work because is the IPS engine that is blocking your traffic.

    Proceed with the IPS log and remove the signature that is blocking the traffic.

    Regards

  • 0 in reply to lferrara

    Hallo Luk,

     

    as you suggested, I enabled the intrusion prevention (WAN to LAN) again, and joined a webex meeting and called in via PC.

    I've looked into the Sophos Log Viewer and saw the following statements:

    2017-03-08 12:06:50
    Signatures
    Drop
    -
    10.0.0.118 :UDP (50975)
    62.109.234.120 :UDP (9000)
    1100016
    LOIC DoS Tool (UDP Traffic)
    Web Services and Applications
    Windows
    Server
    1
    07002
    Open PCAP
    2017-03-08 12:05:57
    Signatures
    Drop
    -
    10.0.0.118 :UDP (58124)
    62.109.234.120 :UDP (9000)
    1100016
    LOIC DoS Tool (UDP Traffic)
    Web Services and Applications
    Windows
    Server
    1
    07002
    Open PCAP
    2017-03-08 12:05:57
    Signatures
    Drop
    -
    10.0.0.118 :UDP (58124)
    62.109.234.120 :UDP (9000)
    1100016
    LOIC DoS Tool (UDP Traffic)
    Web Services and Applications
    Windows
    Server
    1
    07002
    Open PCAP
    2017-03-08 12:05:57
    Signatures
    Drop
    -
    10.0.0.118 :UDP (58124)
    62.109.234.120 :UDP (9000)
    1100016
    LOIC DoS Tool (UDP Traffic)
    Web Services and Applications
    Windows
    Server
    1
    07002
    Open PCAP
    2017-03-08 12:05:57
    Signatures
    Drop
    -
    10.0.0.118 :UDP (58124)
    62.109.234.120 :UDP (9000)
    1100016
    LOIC DoS Tool (UDP Traffic)
    Web Services and Applications
    Windows
    Server
    1
    07002
    Open PCAP
    2017-03-08 12:05:57
    Signatures
    Drop
    -
    10.0.0.118 :UDP (58124)
    62.109.234.120 :UDP (9000)
    1100016
    LOIC DoS Tool (UDP Traffic)
    Web Services and Applications
    Windows
    Server
    1
    07002
    Open PCAP


    I am afraid that the destination IP is not constant. I also saw some log statements with the same signature from the last two days (where I was using WebEx). For each day/webex meeting the destination IP is different.

    The local IP of my machine is 10.0.0.118.

     

    Could you please advise how to allow these signature? I am quite new to Sophos Firewalls, I was using Fortinets ...

    If I understood you right, I have to add a new IPS Signature (Intrusion Prevension -> Custom IPS Signature)?

    But how should the rule look like? Should I use the port as this seems to be constant? Or do you think it's save to use the destination IP address?

     

    again, thanks for your help

    caldi

  • 0 in reply to caldicot

    Could anybode please give me a hint how to create the right signature? - thanks

  • 0 in reply to caldicot

    Today is the first time using WebEx with the new XG firewall.

    In the log viewer it shows under IPS - Signature Name - LOIC DoS Tool (UDP Traffic)

    Then to allow this PROTECT> INTRUSION PROTECTION>IPS POLICIES>Whatever your policy name you use>ADD and Allow the packets for LOIC DoS Tool (UDP Traffic)

     

    Before doing this I could listen to a WebEx without issue, but as soon as I tried to speak all audio would be blocked. (both in and out)

    I am also new to XG firewall and would like to know if a 'Custom IPS Signature' specific for WebEx is achievable

    I've set up the following but not sure when I can test.

    Custom Rule contains:

    content:"webex.com";srcport:53;srcport:1270;srcport:5101;srcport:8554;srcport:7500;srcport:7501;srcport:9000;srcport:9001;

    based on https://it.cornell.edu/webex/webex-technical-requirements

    Then added this to my policy.

     

    Edit:

    Definitely going the FQDN/new rule route

    https://community.sophos.com/kb/en-us/123035 

  • 0 in reply to BKSteve

    Hallo,

    thanks for your help and sorry for my late reply.

     

    I still feel a little bit alinated.
    I was using the default LAN TO WAN policy. I cannot edit this policy.

    So I created a new policy based on the LAN TO WAN.
    There are several rules applied to this policy. The first one is "Browsers_Officetools_Multimedia_VOIP and Instant Messaging".

    Sounds good for me. I am not sure, if I have to check or uncheck the LOIC DOS Tool (UDP) signature for this rule?
    Is it enough to check (or uncheck) the signature for this rule? Or must this be done for every rule within the policy?

    Thanks.

Reply
  • 0 in reply to BKSteve

    Hallo,

    thanks for your help and sorry for my late reply.

     

    I still feel a little bit alinated.
    I was using the default LAN TO WAN policy. I cannot edit this policy.

    So I created a new policy based on the LAN TO WAN.
    There are several rules applied to this policy. The first one is "Browsers_Officetools_Multimedia_VOIP and Instant Messaging".

    Sounds good for me. I am not sure, if I have to check or uncheck the LOIC DOS Tool (UDP) signature for this rule?
    Is it enough to check (or uncheck) the signature for this rule? Or must this be done for every rule within the policy?

    Thanks.

Children
No Data