This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Why is office365 mail send receive very slow?

Environment:
simple setup, latest UTM edition.
Email protection- not setup/not needed.
Intrusion Protection setup
Web filtering setup
firewall setup and working.
Don't do https filtering
everything else working
windows firewall has allow rules (tried it shut off as well)

have subscription to email via office365 online exchange for 2 domains- same issue on domains and on separate clients (osx, win 10, android) same network.

Problem:

outlook clients on win 10 pc's will not connect or take 20mins to connect or take 5 mins to send simple test email to any address. receive is pretty slow too.

Works if:

* I just vpn thru- instant send and receive (bypassing utm)
* I shut off firewall by activating ANY/ANY rule to top.
* thru android phone if only using mobile cell network.



No or little Effect:

* add to web protection > web filtering > Policies > Default content filter action > websites > Allow These Websites
* add all outlook.com IPs to trusted sites
* add to Advanced Threat > exception list
* add to Web Filtering > Filtering Options > exception list. 

^https?://([A-Za-z0-9.-]*\.)?www\.pod51011.outlook\.com/
^https?://([A-Za-z0-9.-]*\.)?www\.outlook.office365\.com/
^https?://([A-Za-z0-9.-]*\.)?www\.smtp.office365\.com/
66.211.180.36
168.63.60.77
132.245.75.162
132.245.250.130
132.245.250.146
132.245.59.114
23.100.86.91
23.99.56.164
132.245.48.66
132.245.59.50
40.84.149.239
104.46.1.211
23.73.29.59

these all connect on 443.

tried variations of the above, no effect.

In the firewall log its all green.

About 3 weeks ago it was working perfect, update issue?
it also worked once today when I added it to the Web Filtering > Filtering Options > exception list

but I rebooted the UTM and it stopped letting it thru.

SO stumped what I am missing to force this to work.



This thread was automatically locked due to age.
Parents
  • Looking thru the logs in the firewall and IPS it seems that the IPS and FW was flagging the 443 attempt as a ICMP attack.

    I made Manual Rule Modification exceptions to the rules in Intrusion Prevention. no avail. they didn't work. even shut it off still not getting emails or sending.

    I think this is a Sophos bug.

    Added a new exception in the exception list:

    ignore;
    pop
    ssl pop
    ssl smtp
    ssl pop

    and disabled the icmp globally as well in the anti-portscan dos setting.

    But it keeps activating these basic rules and dropping packets:

    60001
    60002
    60009
    60014

    2016:08:16-16:55:01 firewall ulogd[5113]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0"

    and there seems to be no way to make these exceptions stick. https://community.sophos.com/kb/en-us/115029

Reply
  • Looking thru the logs in the firewall and IPS it seems that the IPS and FW was flagging the 443 attempt as a ICMP attack.

    I made Manual Rule Modification exceptions to the rules in Intrusion Prevention. no avail. they didn't work. even shut it off still not getting emails or sending.

    I think this is a Sophos bug.

    Added a new exception in the exception list:

    ignore;
    pop
    ssl pop
    ssl smtp
    ssl pop

    and disabled the icmp globally as well in the anti-portscan dos setting.

    But it keeps activating these basic rules and dropping packets:

    60001
    60002
    60009
    60014

    2016:08:16-16:55:01 firewall ulogd[5113]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth0"

    and there seems to be no way to make these exceptions stick. https://community.sophos.com/kb/en-us/115029

Children