Bloxx & Office 365 / office 2013

[rjk1007]

A shot in the dark, Does anyone have experience of Bloxx web filtering, I have a few issues with Office 365(office 2013) connecting even though the office URLs have been added to the all policies allowed list. Also seem to have the same issue with iTunes through our proxy.

 

frustrating

[grant_girdwood]

Hi RJK,

 

I could be down to Microsoft responding to DNS queries using IPv6, if you raise a call with our support team they'll be able to sort this for you in no time

 

cheers,

Grant

[themightymrp]

Am waiting for a Bloxx callback at the minute to do with something similar. I think I've found the answer but they need to edit the Squid settings for me. Found this info on the office365 support forum (very well hidden)

 

outlook.office365.com domain resolves to a set of 25 IP addresses, most of which will reject connections depending on the part of the planet you are in. Squid by default tries the first 10 connection paths (ie the first 10 of those 12 IPv6 addresses) before giving up.

You can avoid this failure by setting "forward_max_tries 25".

[themightymrp]

PS - make sure you have the tick enabled to bypass proxy for local addresses, this needed to be on for me to make Outlook 2013 connect

[rjk1007]

Thanks for the response, Tried calling support team but they weren't willing to speak to me as we haven't renew'd our support contract. :-( so i guess I'll have to wait for forum help or just simply rip the device out.

[themightymrp]

OK, Bloxx support used a remote desktop session to my PC and accessed Bloxx via Putty. The guy disabled IPv6 on the unit and we rebooted. All issues now resolved!

 

If you are no longer paying support contract, ask them for the root password for the unit. Then you can make this change yourself. The command lines are below

 

nano -w /etc/default/grub

 

Find the line GRUB_CMDLINE_LINUX = ""

 

Change it to GRUB_CMDLINE_LINUX = "ipv6.disable=1"

 

Save the changes, then run

 

update-grub

 

Reboot the device using the web interface.

[rjk1007]

Cheers I'll give it a whirl...

[rjk1007]

Just out of interest, I dont suppose anyone knows the ROOT password for the Bloxx. Just putting it out there....

[EmperorPeng]

The list of hosts that you have to allow through BLOXX includes a few sites not mentioned in Apple's support pages. I don't have the list to hand, but BLOXX support will be able to help you.

[themightymrp]

Apple? The opening post is about Office 365 - Microsoft

[themightymrp]

Forget that, my bad - missed the iTunes bit

[themightymrp]

I followed this from the Bloxx support page last week and now our iTunes works spot on:

 

The Apple iTunes Store does not function when requests are challenged to authenticate and/or are decrypted by SSL Intercept. This can be quickly resolved by running through the following steps:

 

 

 

•Once logged in to the UI select Users & Groups > Identification > Settings*

•Bypass authentication for the following;

•.apple.com

•.edgesuite.com

•.itunes.com

•.mzstatic.com

•.verisign.com

•.cddbp.net

•Once the above settings have been saved you will need to then ensure they are allowed on your default groups filtering policies, the easiest way to achieve this if are not sure which policy is assigned to your default group is to allow these domains on all policies via your URL Wizard.

•Next you will need to disable SSL Intercept from decrypting the request, select Filtering and then the SSL Intercept** option

•Scroll to the Tunnel rules (bypass HTTPS filtering) area

•Add the following domains;

•apple.com

 

•mzstatic.com

 

•If you are in transparent mode, you will also need to Add certificates from the following domains to the tunnel list:•gs-loc.apple.com

•itunes.apple.com

•s.mzstatic.com

•xp.apple.com

•p47-buy.itunes.apple.com

 

EDIT - note leading period (dot) before the names of domains in the first list section - you need to include these!

Edited March 17, 2014 by themightymrp

[gshaw]

We had exactly this problem, looks like you've found most of the solutions already as ours needed:

 

1) IPv6 disabled

2) bypass authentication for Office 365 domains (similar to the iTunes above)

3) staff added to software download category (as some of the 365 stuff comes down via the Akamai CDN)

 

There's also a bug in Outlook 2013 (may or may not be fixed in SP1) where AutoDiscover will fail when setting up a profile. That's due to Outlook still trying to go out directly despite the PC having a proxy configured in Internet Options. The only workaround is to use Auto Detect with a WPAD \ PAC file and explicitly state the Office 365 domains to use the proxy server.

 

Enjoy!

[themightymrp]

We had that but just ticked the box in IE proxy settings for bypass proxy for local addresses. Seemed to sort it

[gshaw]

I think it also depends on your internal DNS domain name as well, ours is what Microsoft call split horizon and 365 doesn't like it very much