This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WhatsApp Issue with Web Protection

hello everyone 

 

when ever i turn on web protection for a rule users who can use internet through this rule can use whatsapp application on there phones or web whatsapp

i tried to make a workaround for web whatsapp and created a top rule that allow access to web whatsapp and turned off web protection and that solved web whatsapp problem 

now my problem is with the application it self it wont work until i turn off the web protection 

although i made exception for it in the PROTECT>Web>Exceptions and checked the log viewer and it is all green and all http and https scan & Decrypt  are turned off 

is there any solution for this issue ?

thank you 



This thread was automatically locked due to age.
  • Good point about the ports.  https://www.quora.com/What-is-the-port-number-for-whatsapp

     

    If that is not it, then:


    The problem could be something with web browsing (eg HTTP or HTTPS).  However it could also be DNS timeout or something on some custom ports it uses.  It can be hard to tell, especially since it is hard to packet capture on a mobile device.
     
    Are you doing HTTPS Decryption?  If you are, maybe the app does not like the CA.  You can try disabling it in the firewall rule or in an exception.
     
    If you temporarily put in a high level firewall rule for Source Any Destination Any Service Any with no malware protection or application or web policies (basically super wide open) does that resolve the issue?  If so, then start closing the rule to where is starts being slow.
  • Well after testing it, it was the pharming protection

    I disable it and all went well, I have applied all my web and application rules again and all working fine till this moment...

  • So, few days later, just to be sure thats a problem in my sophos I deactivated all firewall filters and pharming protection. Just had "scan http " option active. I never had the HTTPS scan option active. Do not need that at the moment. First have to get it working without that option to lower complexity.

    What shall I say, it just worked!

    As a next step I will reactivate setting by setting and see what happens. I will start with activating pharming protection and will see.

    I hop to drill down the problem within the next days. Depending on where it stucks, I will try to implement the ideas of the community I have heard so far..

    Thank you in advance, Michael

  • okay, five days have passed and I did not have any problems with pharming protection on... Now brave enough to turn on intrusion preventien for my firewall rule and see whats happening. getting back to you...

  • so I turned back on my Web Policy and the error occured again...

    Web Policy currently just has a default "allow all" and a rule that denies urlgroup with forbidden urls. ...

     

    interesting enough I additionally found out that in log files for the same time stamp the error occured the web policy allows a whatsapp-URL, please see screen attached.

    for the timestamps whatsapp worked as it should, NO entry in firewall web policy log does show up. Different ports are used for the activities in firewall log then.

    can you help to interprete those results with me? really would appreciate ;)

     

  • ahhh, this really is annoying..

    everything works perfectly if i disable my web filter policy.

    but this policy only contains the following rules (see screenhot)

    1: deny all links from url-group (www.example.com)

    2: default allow all

     

     

    how come that once I enable the web policy in my firewall whatsapp not running correctly anymore... that s*cks, to be honest. is it a bug or is the problem in front of my computer (i.e. me )

    would be really glad if someone can help me out of this!

    thank you

  • We use WhatsApp on our iPhones and it has worked fine for the past year (sending messages, voice calls and video chat). I didn't have to setup anything specific either to make it work.

    I'm currently on Sophos XG 17.1.2 (MR-2) and here's an overview of my setup:

    • Allow all LAN to WAN rule that sits at the bottom of my firewall rules.
    • Pharming protection is enabled.
    • The firewall rule that applies to the iPhones has Scan HTTP and Decrypt & Scan HTTPS selected with an IPS policy, Web policy and Application filter enabled.
    • IPS policy only looks for moderate, major and critical severity levels (1-3).
    • Web policy only blocks: Command & Control, Phishing & Fraud, Spam URLs, Spyware & Malware and Hacking.
    • Application filter blocks high and very high risk apps that can bypass the firewall or vulnerabilities (plus a few others).

    The only thing I can think of is I did setup a Web exception that skips HTTPS Decryption for a bunch of stuff (mostly because I don't want secure connections to certain sites being decrypted) that includes the "Online Chat" category, but this was done because I was having issues with another app. I also have the "Information Technology" category in this list (with a few others) because I was having issues with sending photos via iMessage unless I had this category skipping HTTPS Decryption.

    I realize this probably doesn't help too much but just thought I'd provide another data point. I've removed the "Online Chat" category and I'll see if it makes any difference but it sounds like your issue is with web policies and not necessarily HTTPS decryption and scanning.

    ---

    Sophos XG guides for home users: https://shred086.wordpress.com/

  • hey everyone 

    the problem came back one more time to the surface 

    :(

  • Sounds similar but not identical.

    One thing I had in mind: It always had been Android devices with that problem, no one used an iPhone...

    Any ideas? I am running out of ideas, logs dont show anything on this...