This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Lots of "Invalid Traffic" being dropped to Office 365 servers.

Hey folks!  I have a XG firewall on 18.5.2.  For the last year or so, we have been having trouble with random users being prompted to put their Outlook password in for the desktop app.  I have been chalking it up to Microsoft being eh.  But this week it has gotten really bad.  To the point where I have many users that can't use the Outlook desktop app at all. 

In researching that issue today, I found that firewalls can be a cause for this issue with Outlook.  Apparently Outlook does this when it has a spotty internet connection.  So, I started looking through the XG Firewall logs.  I found that there are a very large amount of items that say "Invalid Traffic" and "Could not associate packet to any connection."  Every single instance of this happening has a destination IP going to Microsoft.  Call me crazy, but I don't think that is a coincidence.

I have tried creating a firewall rule to allow all traffic going to the IP range, and it has made no difference.  Does anyone have an idea as to why the XG is terminating connections with Microsoft's servers at an alarming rate?  It's essentially breaking the most important part of our internet.  Surely I am not the only person this has happened to.  I have found a couple threads with similar issues brought up, but there is never a resolution that applies (that I have been able to find).



This thread was automatically locked due to age.
Parents
  • If your firewall rules for this traffic include http and https Web scanning, might be dropping traffic because Office doesn't always play nicely with decryption. You'll want to exclude Office fqdns from being scanned. There are many destination IPs for Office, so the easiest way to accomplish that is to load the recommended Microsoft FQDN exclusions, available as an easy config download here on sophos site: support.sophos.com/.../KB-000038173

Reply
  • If your firewall rules for this traffic include http and https Web scanning, might be dropping traffic because Office doesn't always play nicely with decryption. You'll want to exclude Office fqdns from being scanned. There are many destination IPs for Office, so the easiest way to accomplish that is to load the recommended Microsoft FQDN exclusions, available as an easy config download here on sophos site: support.sophos.com/.../KB-000038173

Children