Smoothwall blocking O365 on our Guest Wifi

[kennysarmy]

6 months ago we had an issue whereby O365 was inaccessible from our guest WiFi.

 

The error on the device when attempting to access O365 is:

 

This site can’t be reachedThe web page at https://www.office.com/ might be temporarily down or it may have moved permanently to a new web address.

ERR_FAILED

 

Smoothwall engineers fixed this issue by adding a whole range of Microsoft IP's in to the "Guardian -> Web Filter -> Exceptions List"

 

We've just discovered this issue is back again!

 

We've made no changes to the list of IP's so I presume Microsoft have updated things?

 

Does anyone know where I can get the updated list of MS IP's to compare against my list of:

 

10.0.0.0/8

10.107.93.9

104.146.128.0/17

104.42.230.91

104.44.218.128/25

104.44.254.128/25

104.44.255.0/25

104.47.0.0/17

108.161.147.0

13.106.4.128/25

13.106.56.0/25

13.107.128.0/22

13.107.136.0/22

13.107.140.6

13.107.140.6/32

13.107.18.10/31

13.107.18.15/32

13.107.6.152/31

13.107.6.156/31

13.107.6.171

13.107.6.171/32

13.107.64.0/18

13.107.7.190/31

13.107.9.155/31

13.80.125.22

13.91.91.243

131.253.33.215

131.253.33.215/32

132.245.0.0/16

134.170.172.128/25

134.170.67.0/25

150.171.40.0/22

157.55.130.0/25

157.55.145.0/25

157.55.155.0/25

157.55.227.192/26

157.55.45.128/25

159.188.150.155

159.190.22.228

17.0.0.0/8

172.16.0.0/12

191.232.2.128/25

191.234.140.0/22

192.168.0.0/16

194.36.112.180

195.188.150.155

199.231.78.0

20.190.128.0/18

20.190.159.4

20.68.47.6

204.79.197.215

204.79.197.215/32

23.103.160.0/20

3.249.63.128-3.249.63.255

40.104.0.0/15

40.107.0.0/16

40.108.128.0/17

40.126.0.0/18

40.81.156.154

40.90.218.198

40.92.0.0/15

40.96.0.0/13

51.143.191.233

52.100.0.0/14

52.104.0.0/14

52.108.0.0/14

52.112.0.0/14

52.120.0.0/14

52.151.77.212

52.169.232.215

52.169.233.130

52.169.235.245

52.169.236.215

52.169.239.174

52.169.239.254

52.174.235.29

52.174.56.180

52.174.56.29

52.174.57.123

52.174.58.53

52.174.61.120

52.174.62.82

52.178.208.12

52.178.71.234

52.183.75.62

52.184.165.82

52.215.127.0-52.215.127.255

52.215.253.0-52.215.253.63

52.238.106.116

52.238.106.116/32

52.238.119.141/32

52.238.78.88

52.238.78.88/32

52.244.160.207/32

52.244.203.72/32

52.244.207.172/32

52.244.223.198/32

52.244.37.168/32

52.247.150.191

52.247.150.191/32

52.96.0.0/14

54.171.127.192-54.171.127.255

54.193.207.248

62.171.194.111

64.156.192.246

64.62.142.12

64.62.142.2

65.54.170.128/25

150.171.40.0/22

[Mako]

Here you go: https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

[kennysarmy]

Here you go: https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

 

Cheers - this was last updated 11/07/2022 - I'm reading that as 11th of July - I copied out ALL the IP's on this webpage and added them to Smoothwall and it's not made any difference - unless Smoothwall cache needs clearing :/

[Mako]

Is it consistently failing?

 

Last time something like that happened, it was an issue with O365 itself but I can't see anything in the admin centre that would indicate it. Like you say, they haven't been updated in some time.

 

You could try flushing the DNS of the client machine and reconnecting.

[kennysarmy]

Is it consistently failing?

 

Last time something like that happened, it was an issue with O365 itself but I can't see anything in the admin centre that would indicate it. Like you say, they haven't been updated in some time.

 

You could try flushing the DNS of the client machine and reconnecting.

 

Thanks.

 

It's broken consistently on all devices we connect to the guest WiFi.

 

[Mako]

Do devices on the WiFi get different filtering policies than your wired?

[kennysarmy]

Do devices on the WiFi get different filtering policies than your wired?

 

Slightly, but there is a Smoothwall filtering policy which has Office 365 unfiltered as the second top policy.

 

[Mako]

I feel like it's something obvious. Usually plumbing all the addresses from the MS documentation solves everything. If it's only WiFi then it must be something to do with how that is set up, or routed, or filtered.

 

Possibly the obvious - have you tried a different browser? Or is this using the desktop apps?

 

I'll muse on it some more.

[kennysarmy]

I feel like it's something obvious. Usually plumbing all the addresses from the MS documentation solves everything. If it's only WiFi then it must be something to do with how that is set up, or routed, or filtered.

 

Possibly the obvious - have you tried a different browser? Or is this using the desktop apps?

 

I'll muse on it some more.

 

Installed Firefox on my phone and different message but office 365 inaccessible.

 

Wonder if there is any app I can put on my phone that would dig a bit deeper to what's blocking the connection :/

[36Degrees]

Installed Firefox on my phone and different message but office 365 inaccessible.

 

Wonder if there is any app I can put on my phone that would dig a bit deeper to what's blocking the connection :/

 

I've used HTTPWatch (on PC in Chrome) before to diagnose issues i.e. unblocked domain in Smoothwall but some element of page is from a completely different, blocked domain.

[Mako]

Just a thought - are the Microsoft addresses/IPs etc also in your HTTPS policies?

 

Here I set them to not be inspected for Everyone to avoid issues.

[kennysarmy]

Just a thought - are the Microsoft addresses/IPs etc also in your HTTPS policies?

 

Here I set them to not be inspected for Everyone to avoid issues.

 

Hi,

 

Yes the top policy is :

 

Everyone

Office 365 URLS

Microsoft Office 365

Everywhere

Always

Do Not Inspect

 

- - - Updated - - -

 

I've used HTTPWatch (on PC in Chrome) before to diagnose issues i.e. unblocked domain in Smoothwall but some element of page is from a completely different, blocked domain.

 

Installing on a test laptop now.

 

Cheers

[kennysarmy]

I've used HTTPWatch (on PC in Chrome) before to diagnose issues i.e. unblocked domain in Smoothwall but some element of page is from a completely different, blocked domain.

 

Sadly the Free version won't give any information on the failed URL's and there is no demo on the pro version

[PaddyNewman]

Wireshark would be my go to if using a Windows laptop. See where its going, what does a report say though... if you aren't performing HTTPS inspection, that just sounds like something silly, matching a blocked word, blocked URL rather than allowed. You shouldn't really need to use IP ranges as exemptions.

[kennysarmy]

Wireshark would be my go to if using a Windows laptop. See where its going, what does a report say though... if you aren't performing HTTPS inspection, that just sounds like something silly, matching a blocked word, blocked URL rather than allowed. You shouldn't really need to use IP ranges as exemptions.

 

I've created two temp. policies:

 

1.HTTPS inspection policy.

Guests

Everything

Do NOT Inspect

 

2. Web filter policy

Guests

Everything

Do NOT Filter.

 

 

I still can't get on http://www.office.com

 

[ibpalle]

What is the error in the browser or is it just for applications?

 

The HTTPS method set in your Smoothwall for the transparent proxy the users are going through, what option is selected there? It should be 'Allow transparent incompatible and filter others by cert'

 

Are you excluding the office IPs from being intercepted by the transparent proxy as per the first post?

[kennysarmy]

What is the error in the browser or is it just for applications?

 

The HTTPS method set in your Smoothwall for the transparent proxy the users are going through, what option is selected there? It should be 'Allow transparent incompatible and filter others by cert'

 

Are you excluding the office IPs from being intercepted by the transparent proxy as per the first post?

 

Error in Chrome is:

 

This site can't be reached

http://www.office.com took too long to respond

ERR_CONNECTON_TIMED_OUT

 

>>>It should be 'Allow transparent incompatible and filter others by cert'

 

This is how it is set for the Guest Interface.

 

 

>>>Are you excluding the office IPs from being intercepted by the transparent proxy as per the first post?

 

If you mean are the IP's here: Guardian -> Web Filter -> Exceptions, then yes, there are 111 entries in the list - all from your tech article.

 

https://kb.smoothwall.com/hc/en-us/articles/360010312859-Microsoft-Office-365-IP-and-Domain-List-for-Proxy-Exceptions

[kennysarmy]

I opened a call last Thu with Smoothwall : 382653 - still waiting for someone to call me back.

 

 

But it's getting pretty inconvenient (and embarrassing) that none of the guests to the school are able to access O365 :/

[ibpalle]

Connection timed out - if that is an error generated by the proxy it means the proxy cant get to the site. You should see code 503 in the code column of the web filter log viewer for access to office.com. If the Smoothwall is also the firewall check that external routing is set correctly in networking - configuration - SNAT and LLB policies and if it's not, make sure the Smoothwall IP is not blocked on the upstream firewall.

[kennysarmy]

Connection timed out - if that is an error generated by the proxy it means the proxy cant get to the site. You should see code 503 in the code column of the web filter log viewer for access to office.com.

 

 

When I filter by IP address of the Guest I can see the traffic when I browse - but when I try to browse to office.com - no results appear in the web filter.

 

 

 

The Smoothwall is not the firewall.

 

 

Thanks for trying to help.

Edited November 14, 2022 by kennysarmy

[kennysarmy]

make sure the Smoothwall IP is not blocked on the upstream firewall.

 

If that was the case would that not affect ALL browsing - whereas our issues seem very specific to just office.com

[ibpalle]

If you can't see office.com in the filter logs, it's unlikely to be a filtering issue - could be you are excluding the office365 IPs so that traffic is not intercepted. Is the error in the browser generated by the proxy or the browser itself?

[kennysarmy]

If you can't see office.com in the filter logs, it's unlikely to be a filtering issue - could be you are excluding the office365 IPs so that traffic is not intercepted. Is the error in the browser generated by the proxy or the browser itself?

 

Thanks, I don't think it's a smoothwall error page - so I presume it's a browser generated one.

 

Regarding, "could you be excluding the office365 IPs so that traffic is not intercepted." - > how would I check this?

 

Just to re-iterate, Office.com is accessible by our BYOD Wifi and from fixed PC's on the network fine - it's just the Guest Wifi which is broken for office.com access.

[PaddyNewman]

What DNS servers do you use for Guest. Not seeing a request is typically a DNS failure from my end on a non Smoothwall proxy setup.

 

Can you go on guest, nslookup for http://www.office.com ? Do you get results...

[kennysarmy]

What DNS servers do you use for Guest. Not seeing a request is typically a DNS failure from my end on a non Smoothwall proxy setup.

 

Can you go on guest, nslookup for http://www.office.com ? Do you get results...

 

All websites give the same result when on the guest network.

 

>> UnKnown can't find : No response from server