Zoom On Premise

Hello Sophos User2506,

Thank you for contacting the Sophos Community.

So if you are expecting the traffic to come from 173.288.57.201 and not another IP then your Firewall rule is correct.

Did you select automatic Firewall rule and have another Firewall from the ZoomOnPremZC to 173.288.57.201 (shouldn't be necessary if they are the ones initiating the traffic).

If you do a tcpdump on the WAN interface and that specific port what do you see?

#tcpdump -eni any host 173.288.57.201 and port 9001 

Do the same for the onpremise Zoom

#tcpdump -eni any host x.x.x.x and port 8802

Regards,

Hi and welcome to the UTM Community!

Please show a picture of the Edit of the DNAT with the 9001 and 8802 services open.  What if you make UDP 9001 and 8802 and TCP 9001 and 8802 and then put the TCP ports in one DNAT and the UDP ports in another?

What/where is "External IP address assigned to meeting connector"?

Cheers - Bob

Hello,

Thank you for the follow-up.

I am seeing wrong or the IP you set is not the 173.288.57.201 for your ZoomMeetingConnector?

Regards,

Here is the example on Zoom site:

As you can see 173.228.57.201 is their example.

Man, it looks like you're following their instructions to the letter.  I'm still concerned that using TCP/UDP in the Service definitions is something that WebAdmin and the config daemon don't know how to handle.  If you're leery of making separate TCP and UDP definitions and separate NAT rules for TCP and UDP, get a case open with Sophos Support.  Please let us know what they say.

Cheers - Bob

Changed the settings per recommendation and it still won't allow iPad to connect from the outside. All I get is connecting than it times out. 

I cannot do a dump on the Zoom server.

Put in official ticket will Sophos. Will let you know the outcomes. Until then thank you for the help.

OH - I think I see the problem.  The "ZoomMeetingConnectorControllerPortForwarding" needs to be an Additional IP on the External interface, so your Traffic Selector should be, for example:

Internet IPv4 -> Zoom9001 -> External [ZoomMeetingConnectorControllerPortForwarding] (Address)

Or, if the IP is the same as "External (WAN) (Address)"

Internet IPv4 -> Zoom9001 -> External (WAN) (Address)

Your TCPUDP definitions might work there.  Please let us know if they do.

Cheers - Bob

Hello Sophos User2506,

As Bob mentioned it seems like you need an Additional IP for the Meeting Connector.

Please share the Case ID so I can also follow up internally.

Regards,