O365 Exchabge via Lightspeed box is slow

[bodminman]

Hi there,

 

do any of you Lightspeed users use O365 and are you finding logging into it extremely slow?

 

Thanks

 

 

(Argh sorry about the spelling mistake in the title )

[bodminman]

Ah ha!

 

After a rather busy day I have finally managed to investigate this issue further.

 

When using IE to browse and use login.microsoftonline.com it's painfully slow. Using Firefox or Chrome works a charm.

 

So looking into the settings for IE, there is one for 'Check for server certificate revocation'. If enabled is what's killing the https connections. When this is disabled access to https sites goes through smoothly on IE.

 

I'm tempted to just disable this via GPO and be done with it but I'd rather ask the Oracle aka Edugeekers about whether there's another way to fix this without compromising things.

 

Thanks

[Edu-IT]

So what is Lightspeed doing to slow that down?

[bodminman]

So what is Lightspeed doing to slow that down?

 

Haven't a clue but when I sent the internet traffic from my PC via the old smart cache it works fine but Lightspeed at the moment aren't convinced that it's a Lightspeed issue.

 

I have added my PC as an exclusion on the Lighyspeed box but the issue is still there.

 

I will plug a laptop directly into the router tomorrow and see what that brings up!

[kmount]

Does it work if you disable CRL checking but still go through the Lightspeed does it still happen?

 

Likewise, having that enabled but not going through the Lightspeed what happens?

[bodminman]

Does it work if you disable CRL checking but still go through the Lightspeed does it still happen?

 

Likewise, having that enabled but not going through the Lightspeed what happens?

 

Disabling this setting within IE makes iE behave normally.

 

I will setup a laptop tomorrow that will go through to the we without going via the Lightspeed box and see what happens.

 

Prior to having the Lightspeed box in place this wasn't an issue.

[bodminman]

I have just got my laptop accessing the internet directly through our firewall/router and there was no issue what so ever when having 'Check for server certificate revocation' enabled.

 

When I set the laptop up to go back through the LS box with this IE setting in place then we get the issues with accessing https stuff again.

 

I have fired this back over to Lightspeed so we shall see what they say.

 

Very odd!

[Rick2134]

bodminman,

 

I did get a reply from Lightspeed which was no help what so ever as i am experiencing the same issues at out site;

The connections to Office 365 appears to be to random external IP Addresses on Port 137 when I looked through your Web Activity Report yesterday, if the server was on site it could be added to the Rockets Internal Ignore list. - What a load of rubbish!

 

Still awaiting for an educated answer

[bodminman]

Cheers Rick. I'm glad to hear I'm not alone with this issue!!!

[Edu-IT]

So I assume connecting to Office 365 through Outlook operates normally? We're going live with Lightspeed soon so be interesting to see.

[bodminman]

So I assume connecting to Office 365 through Outlook operates normally? We're going live with Lightspeed soon so be interesting to see.

 

At the moment I can't get my outlook to connect through to O365 although it has worked but it stopped earlier this week. I shall be tackling this tomorrow and I will let you know how I get on.

[Rick2134]

Make sure you have P2P turned off on your Lightspeed box, I am now getting the following error when users try and access out o365 SharePoint;

If you retry the SharePoint link again it allows you through.....

 

[Edu-IT]

Make sure you have P2P turned off on your Lightspeed box, I am now getting the following error when users try and access out o365 SharePoint;

If you retry the SharePoint link again it allows you through.....

 

[ATTACH=CONFIG]21439[/ATTACH]

I'm seeing that too actually if I use mail.ourdomain.com. If I go to the proper login page it works.

[tom_newton]

Is lightspeed blocking access to the CRLs you need? That could slow things down as IE will look to see if the cert has been revoked and have to wait $timeout seconds to find out that it can't...would hope lightspeed have a CRL category you can allow?

[Rick2134]

o365 was blocked under 'forums & email' this has been set to allow for staff/students, we are still experiencing slow logins to o365

[Edu-IT]

Is lightspeed blocking access to the CRLs you need? That could slow things down as IE will look to see if the cert has been revoked and have to wait $timeout seconds to find out that it can't...would hope lightspeed have a CRL category you can allow?

This was happening at home for me.

[Edu-IT]

@bodminman Do you use Office 365 with Outlook and are you using HTTPS decryption on the Rocket? I.e Is the Rocket acting as a proxy server?

[bodminman]

@bodminman Do you use Office 365 with Outlook and are you using HTTPS decryption on the Rocket? I.e Is the Rocket acting as a proxy server?

@Edu-IT - As a school we don't use Outlook although I do have it configured on my machine.

 

The Rocket is not acting as a proxy server but we do have the 'Decode SSL Certs' option enabled under Web Filter/General.

[Edu-IT]

Is that with Office 365? @bodminman

[bodminman]

Is that with Office 365? @bodminman

@Edu-IT - Yes it is.

[Edu-IT]

Do you have any problems with Outlook on it, such as Mailtips not working? I suspect not if you aren't using it as a proxy as I don't think it decrypts SSL in non proxy mode which is where I think the issue is.

[bodminman]

Do you have any problems with Outlook on it, such as Mailtips not working? I suspect not if you aren't using it as a proxy as I don't think it decrypts SSL in non proxy mode which is where I think the issue is.

 

Nah, outlook works fine tbh but during our trial when we did have it setup as a proxy I couldn't get outlook to connect at all. However I was assured that all would be fine when it's inline.

[Edu-IT]

Have you tried recently? Mine keeps complaining that MailTips can't be retrieved and I can't work out why.

[bodminman]

Sorry to drag this up again but I want to update you where I'm up to!

 

Basically I have found the cause and would like some advice on implementing the cure!

 

When I run 'netsh winhttp show proxy' the result shows our old proxy server/port. This info is visible within IE but not enabled.

 

When I run 'netsh winhttp reset proxy' (settin git to 'Direct Access')browsing the web works as normal and we have now issues at all, even with 'Check for server certificate revocation' enabled.

 

How can I set the machines to do the 'netsh winhttp reset proxy' without me having to go around them all manually? Startup script?

 

Thanks

[Willott]

If the info shows in IE but is not enabled, do you know what's populating it? Something GPO based? Could you do a GPP with the info cleared (or set to new proxy server/port) and disabled maybe rather than script?