Protect network traffic blocks EWS service URL from within a program

Jonas Havemann TimberTec GmbH 7 days ago

Hello, we have a problem with the feature “Protect network traffic”.

We are using a terminal server, on which employees work with a program that uses EWS to send mails.

We now have the problem that Sophos blocks the automatic login process via the Service URL https://outlook.office365.com/EWS/Exchange.asmx.

We have already tried setting process exceptions for the program, web exceptions for the Microsoft office addresses and IPS exceptions for the Microsoft IPs.

Its also strange that sometimes a connection comes through. If you spam the login process you will sometimes get connected, but only rarely.

I would be thankful for any tips that you have for that problem, and I am sorry if my English is a bit rusty.

Links for the Microsoft 365-URLs und-IPs

https://support.sophos.com/support/s/article/KB-000038121?language=en_US

Microsoft 365-URLs und-IP-Adressbereiche - Microsoft 365 Enterprise | Microsoft Learn

Parents

0 Qoosh 5 days ago

Hi Jonas,

Thanks for reaching out to the Sophos Community Forum.

May I ask if you have tried to add a loopback IP address exclusion for the affected users? This exclusion will need to be entered in the Threat Protection policy as a "Website Scanning Exclusion" with the IP address "127.0.0.1" for it to apply correctly.

If the web-app and local program need to interact with one another, this traffic may be routed through the loopback interface.

Let me know if this works.

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Qoosh 5 days ago

Hi Jonas,

Thanks for reaching out to the Sophos Community Forum.

May I ask if you have tried to add a loopback IP address exclusion for the affected users? This exclusion will need to be entered in the Threat Protection policy as a "Website Scanning Exclusion" with the IP address "127.0.0.1" for it to apply correctly.

If the web-app and local program need to interact with one another, this traffic may be routed through the loopback interface.

Let me know if this works.

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 Jonas Havemann TimberTec GmbH 3 days ago in reply to Qoosh

Hi, thank you for your response. Sadly, localhost is already set as an exclusion.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel