WSA S170 unable to access office365

[Erland Medrano]

Hi,

We would like to know what is the cause of unable to connect to office365 even if we can ping the outlook.office365.com in ironport.

[Handy Putra]

Hi Erland,

Have you checked the accesslogs from the WSA when trying to connect to office365 to see anything that been blocked by policy?

Also in the case of Office365, normally recommend to bypass authentication from WSA for this kind of traffic since Office365 can not provide good proxy authentication especially with PAC file or WCCP redirection (transparent deployment).

[Erland Medrano]

what is the limititation of WSA? and also where in OSI layer belong the WSA?

[Handy Putra]

WSA is only performing layer 7 only. 

What sort of limitation that you are referring.

[Filippo Carzaniga]

I have to create un "custom category" with this subnet and *.fqdn:

https://support.office.com/it-it/article/URLs-and-IP-address-ranges-for-Office-365-operated-by-21Vianet-5c47c07d-f9b6-4b78-a329-bfdc1b6da7a0?ui=it-IT&rs=it-IT&ad=IT

Then you have to create the Indentity with that custom-category and bypass authentication.

After you have to create NEW ACCESS POLICY to "allow" traffic "http" and NEW DECRYPTION POLICY to passthtrought the "https" traffic.

[hamirza]

You can take advantage of Custom URL External Feeds feature only available in WSA 10.x onwards for Skype and Office 365, as the external feed will have the exact IPs/hosts and will be updated every configured interval, Office 365 also includes the Skype destinations as well hence this can be leveraged for Skype issues as well.

How to Enable Office 365(Includes Skype as well) External Feeds in AsyncOS 10.0 for Cisco Web Security

https://www.cisco.com/c/dam/en/us/products/collateral/security/web-security-appliance/guide-c07-738382.pdf

[dncl]

Please be advised that the Office365 feed provided by Microsoft contains other sites you may not want to allow, such as:

Facebook

Youtube

mail.google.com

dropbox.com

evernote.com

HUGE vulnerability!!!

We manually export the XML into another XML that we then clean up. Very manual and time consuming... and defeats the purpose of the XML feed.

[ondjultomte]

Really ? do they add more the the absolute minimum of their own IPs? That is really bad and reduces the functionality of the function.

[dncl]

Has anyone investigated this Microsoft script to generate a PAC file that will bypass WSA for Office365 traffic?

https://blogs.technet.microsoft.com/undocumentedfeatures/2015/11/16/office-365-pac-file/

A concern would be a PAC file that's 300+ lines long... Any imput there?

Thanks!