Smoothwall Firewall Microsoft 365

[dazza007]

I am stuggling to understand why even though all the Microsoft 365 exceptions are entered onto the smoothwall - sites double checked and ip addresses double checked in https exceptions/auth/web exceptions I am getting firewall incoming drops from the MS servers ip addresses.

I understand that the smoothwall will track the outgoing connection and allow the incoming one corresponding, but I am having difficult figuring out what I am seeing.

Surely the MS ip addresses are not trying to open a connection?

Evidently I am missing something or something is not right?

for example 52.97.129.242 is definitely Microsoft 365 list 52.96.0.0/14

 

Plus The network connectivity tool has stopped going through the firewall for no apparent reason!

[TechMonkey]

Depends, it could be someone running a server on Azure and scanning you or running some attacks, so Smoothwall is doing its job. Also just because a web address is set to be allowed in the filter, doesn't mean the firewall will let it through. Does the firewall say what rule it is caught by?

[dazza007]

Thanks!

It is flagged as Bad External Traffic

[TechMonkey]

I have some traffic from that IP in my firewall, also as Bad External Traffic on port 53766. Not seen any bad side effects. Any can't find anything linking that port with M365 so I wouldn't be worried.

[dazza007]

Having major teams issues again as site returns to teams teaching. Must be the third time I have gone back to smoothwall. Numerous firewall Bad Traffic seems related to non-teams udp ports. Teams has group policy, QoS wired Qos. TCP ports all in ranges discussed above. So issue persists!

[E_G_R2]

what size link do you have and which model Smoothy are you using?

 

I've experienced something similar during lock down one at my previous school and it was the smoothy not being right for our connection.

[dazza007]

It is an s14.

We are getting teams traffic from teams ip addresses and ports on the external interface being dropped so a fun day to be had by all!

Smoothwall looked at this further for me. We were getting dropped packets and they changed the setting in the ring buffer and increased the mtu back to 1500

The ISP are pushing through packets of 7000-15,000 mtu (not sure if this is causing issues) but it can't help

[E_G_R2]

Would think an S14 was OK ours was a S7 if I remember correctly and just couldn't handle the volume of Teams traffic at the time

[wintech1]

Are you having issues with SharePoint and Office Online too? It's really hit and miss for us. At times toolbars don't load etc.

 

I can't see anything else to tweak and support appear none existent at the minute.

[dazza007]

I see 365 https traffic blocking

Have you run the network connectivity tool?

[ChrisC]

It is an s14.

We are getting teams traffic from teams ip addresses and ports on the external interface being dropped so a fun day to be had by all!

Smoothwall looked at this further for me. We were getting dropped packets and they changed the setting in the ring buffer and increased the mtu back to 1500

The ISP are pushing through packets of 7000-15,000 mtu (not sure if this is causing issues) but it can't help

How old is the appliance?

 

I saw a school that had some horrible teams packet loss in the call quality dashboard that was really affecting things.

 

In the end it seemed to be down to a failing disk and the issue was only being picked up during teams calls due to the noticeable drops in the audio/video quality.

[dazza007]

Hmm quite old.....

Another day, problem seems mainly related to screensharing