Moos3h Posted October 9, 2015 Posted October 9, 2015 (edited) Hi all, I'm having what I think is a firewall/filtering problem, hence why it's in here but I'm happy to be proved wrong! We are trying to use the Google Drive Sync on our PCs, a mix of Windows 7, 8.1 and 10 and NONE of them are working - the sync tool installs but then says 'Unable to connect'. We are on the SWGfL and they swear blind that both firewall and filtering rules are set to allow the Google stuff, but I'm having a hard time proving or disproving that. This is what we've tried already: 1). Reinstalled the application, downloading the latest version 2). Removed the 'Google' folder under %localappdata% 3). Checked that the proxy is set in IE (sslfilter.staffproxy.swgfl.org.uk on port 8080) 4). Checked that the RM certificate is installed, verified with their own testing tool 5). Run 'winhttp set proxy proxy-server="http=sslfilter.staffproxy.swgfl.org.uk:8080;https=sslfilter.staffproxy.swgfl.org.uk:8080" to set a system-wide proxy 6). Turned off antivirus 7). I've run Wireshark and can see the handshake (using TLSv1.1) between the application and the remote server but STILL nothing, so I do think there is some connectivity there. Absolutely no joy. The issue is compounded by the fact that the Google Drive Sync does not allow you actually specify a proxy server, the options are limited to 'Auto detect' (Pick up from IE, maybe?) or 'Direct Connection'. We've tried both and no different. The logs that are generated by the Google Drive sync all complain about a lack of network connectivity. Please, does anyone have this working? Here's the thing, up until about 2 weeks ago, ours did! I heard a rumour that during that time the SWGfL have applied some rules across the board to open up Google and Office 365 but I've not found anything from a cursory Google to back that up. Any advice, gratefully received! Thanks a lot! *** EDITED TO ADD - Have the same problem with non-domained machines as I do with those on the domain *** Edited October 9, 2015 by Moos3h
Steve21 Posted October 9, 2015 Posted October 9, 2015 No idea on the actual issue but in regards to your SWGFL changes: In recognition of demand for access to Apple, O365 and Google Apps we have taken the steps to open ports for these services for all customers. As a result you will no longer need to raise a change request to allow firewall access to these services Steve
RichCowell Posted October 9, 2015 Posted October 9, 2015 Can't help with the connectivity issues as I've just allowed all traffic out through the firewall, but have you tried contacting Google? Their support is pretty good - I had an issue with Google Drive Sync a while ago, turned out it was because I moved the data I wanted to back up to the root of a drive with shadow copies enabled, so it was trying to sync that hidden system folder too - moved it and it was okay... but they were pretty good helping...
Moos3h Posted October 9, 2015 Author Posted October 9, 2015 Rich - I hadn't actually, largely because I assumed they wouldn't be that interested - heartening to know you had some success. How did you get in touch? Just wondering about the best route to go to get to the right person!
jamesrhart Posted October 9, 2015 Posted October 9, 2015 Don't SWGfL intercept Google SSL now? I think this breaks sync.
RichCowell Posted October 9, 2015 Posted October 9, 2015 Rich - I hadn't actually, largely because I assumed they wouldn't be that interested - heartening to know you had some success. How did you get in touch? Just wondering about the best route to go to get to the right person! Started with an online chat when it's available - https://support.google.com/drive/?hl=en#topic=14940&contact=1 Don't SWGfL intercept Google SSL now? I think this breaks sync. Not sure re. SWGfL but it wouldn't surprise me if that's what's causing it - more an more services are getting wise to interception like that - I've had to add loads to bypass the scanning for legitimate sites over the past few weeks...
Moos3h Posted October 10, 2015 Author Posted October 10, 2015 Thanks folks - I've submitted a few logs to Google so we'll see, but I bet the answer that comes back is 'it can't communicate' - useful to know, but it means going back to SWGfL
Opendium_Steve Posted October 12, 2015 Posted October 12, 2015 We are trying to use the Google Drive Sync on our PCs, a mix of Windows 7, 8.1 and 10 and NONE of them are working - the sync tool installs but then says 'Unable to connect'. We are on the SWGfL and they swear blind that both firewall and filtering rules are set to allow the Google stuff, but I'm having a hard time proving or disproving that. Google Drive has a couple of problems with filtering systems: 1. It validates certificates against its own internal list of trusted certification authorities, rather than using your machine's certificate store. So if your filter does HTTPS interception on Google Drive connections it'll break. 2. Google periodically release versions that have broken support for proxies, so all bets are off as to whether its using the proxy or not (and therefore probably being caught by a transparent proxy, which may behave differently). A few days ago Google confirmed to us that there is a problem with the latest Google Drive release and proxies. (As mentioned, this has happened a few times, so I'm guessing that Google don't test with a proxy before releasing). They have asked one of our customers to test a new version that has not yet been released (I've got no feedback on that yet though). 3). Checked that the proxy is set in IE (sslfilter.staffproxy.swgfl.org.uk on port 8080) See (2) above - it may not be using the proxy. 7). I've run Wireshark and can see the handshake (using TLSv1.1) between the application and the remote server but STILL nothing, so I do think there is some connectivity there. A couple of things to check with wireshark: 1. is it using the proxy or not? (if its using the proxy you'll see connections to port 8080, if not it'll be connecting to 443). 2. which certification authority has signed the certificate Google is presenting - you should be able to see whether its a real Google certificate or if the SWGfL have intercepted it. As mentioned, in my experience Google Drive can't be made to work with interception because it doesn't use the machine's certificate store to validate certificates. With regards to Google Support, they don't seem too bad once you've convinced them that there _is_ actually a problem. The first couple of times you raise an issue they seem to just send back a standard list of trouble shooting steps that are no good to anyone
Moos3h Posted October 13, 2015 Author Posted October 13, 2015 Thanks for the help - sadly Google's help has been a bit 'choccie teapot' so far so I'm getting nowhere there and surprise, surprise SWGfL haven't even responded. Oddly, since the other day where I could see a lot more activity in Wireshark, I can now only see a very small amount of traffic and Google Drive is popping up a message to say it can't connect to the Internet - again, on all machines regardless of being on the domain or off. I've poked about and outgoing traffic seems to use 8080 but incoming traffic is trying to connect to 443 and I'm seeing spurious retransmissions so I think that's fairly indicative that there's a lack of connectivity. The issue is, who's problem is it (apart from mine!)? The Google Drive app NEEDS to use the proxy and it's not so I guess it's a Google issue, don't rate my chances of getting anywhere fast on that score...yet I know of another school on SWGffL that DOES have this working without issues, so that could still point to different filtering/firewall rules not helping matters. Sigh. Beer time.
jamesrhart Posted October 13, 2015 Posted October 13, 2015 (edited) Have you thought about getting SWGfL to enable the 'transparent proxy' this negates the need to enter the proxy information (in 99% of apps), so if that is the issue with drive this should resolve it as drive will no longer need to know about the proxy. I had it added to my wife's school (on SWGfL) and it works a treat at £0 cost. Taken from: http://esi.swgfl.org.uk/shops/swgfl/Product.aspx?cref=PD1764528 Transparent filtering module With 'Bring Your Own Device' schemes allowing more and more personally owned computers and smartphones into school, the RM SafetyNet Plus Transparent Filtering Module allows you to provide filtering to all devices on your network, without the management overhead. What is Transparent Filtering? Transparent Filtering is web filtering without the use of a proxy server. What does this mean? It means that, with the Transparent Filtering Module, you have the ability to filter any device that uses the school Internet connection, without having to configure the user's device. Whether it be a school laptop, a staff iPad or a student's Android phone, filtering is applied automatically whilst still giving you full control via the SafetyNet Plus Administration Interface. Edited October 13, 2015 by jamesrhart
Moos3h Posted October 13, 2015 Author Posted October 13, 2015 Thanks James - I guess I'd want to just check what this had the potential to break, but it certainly seems a good idea (I didn't know they did it!). I'll stick another ticket into SWGfL to ask. Thanks again!
jamesrhart Posted October 13, 2015 Posted October 13, 2015 When I did it at my wife's school the proxy carried on running (and still does), so we just slowly turned off the proxy settings, I think the only thing you need the proxy for is when you want to use the staff.login - otherwise nothing broke and all a lot simpler going forward.
Opendium_Steve Posted October 14, 2015 Posted October 14, 2015 I'd say that everyone needs a transparent proxy these days - there's just too much software out there that has broken proxy support. That said, getting applications to use the proxy properly wherever possible is usually best, leaving the transparent proxy as a backup for those that can't be made to work - transparent proxies are generally a little more limited than non-transparent ones. The "pre-release" version of Google Drive that Google asked one of our customers to try didn't resolve the issue, so Google have sent yet another pre-release version to test... If you want to send me a wireshark log, I can have a look at it for you, although I suspect I won't be able to tell you anything new. 1
Moos3h Posted October 14, 2015 Author Posted October 14, 2015 Thanks for the offer Steve - as I mentioned in the other Google Drive thread, reverting to 1.24 has resolved this so you're 100% accurate in pinpointing the current release having 'issues' with non-transparent proxies. I've reported it to Google, although their support has been pretty poor so far - hopefully enough people will be making a noise that they will get this sorted soon (and test it properly!) Cheers, James
Opendium_Steve Posted October 14, 2015 Posted October 14, 2015 The school who has been having problems reported that the latest pre-release version that Google sent them fixes their problems, so hopefully Google will release this to the general public soon. 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now