Goto Meeting/ Goto Training

Hi Jay,

Add the URLs in Web protection> Filtering option> Misc> Skip transparent mode (destination). Uncheck the "Allow HTTP/S traffic for listed hosts/nets"

Hope that helps:)

sachingurung said:

Hi Jay,

Add the URLs in Web protection> Filtering option> Misc> Skip transparent mode (destination). Uncheck the "Allow HTTP/S traffic for listed hosts/nets"

Hope that helps:)

 

I did this and all the Goto Meeting URLs stopped working.

Hi JayMan,

Show us a picture of your configuration to allow GoTo application. Next, take SSH to UTM and login as root. Check http.log and afc.log, do you see anything dropping here.

You can also refer #1 in the Rulz by Bob here. Provide us the logs, look into the logs and if you catch any GoTo URL is blocked via UTM add it in the allowed list.

Thanks

Hi JayMan,

Show us a picture of your configuration to allow GoTo application. Next, take SSH to UTM and login as root. Check http.log and afc.log, do you see anything dropping here.

You can also refer #1 in the Rulz by Bob here. Provide us the logs, look into the logs and if you catch any GoTo URL is blocked via UTM add it in the allowed list.

Thanks

 Ok so here is my websites and exceptions.    In websites I put in all the URL's Citrix provides and marked them as web meetings and then in exceptions I checked off everything for web meetings.

Here is something else.  If I set it to only decrypt and scan some categories leaving out webmeetings.  Everything opens fine.  How is that different from putting in an exception to not check SSL.

I'm sorry, JayMan, but this is just getting too long and too complex to follow.  Please post a summary of the current situation so that we can start from there instead of from the top.

Cheers - Bob

Ok Summary:

Goto Meeting and Goto Training Connection issues with Sophos UTM seems to be SSL based.

Added in all the URL's and IP's Citrix provides for Firewall configs for all the Goto Apps into Websites (see picture below). Each website is retagged as Web meetings and trusted.

Made an Web Exception based on AD group and the category Web Meetings (see next image) which includes bypassing everything but authentication so the AD groups work.

When I try to load the Goto Meeting or Goto Training App it fails. Doesn't show any blocks in the UTM Logs just doesn't load.  Goto Meeting Logs show cert errors (from post #1  2016-11-10 13:20:11.246 PST i: [g2mcomm] <mcast-agent> Certificate verification using Local Certificate Store failed with error. Logging peer certificate....)

If I tell the UTM not to decrypt the HTTPS as seen below the websites all load without issue.

So why doesn't the SSL Check Exceptions  not do the same thing as the HTTPS Scan Settings?  Shouldn't checking SSL scanning when making an exception force it to allow HTTPS/SSL traffic to pass without issue the same way telling it not to decrypt does above?

Hopefully this makes more sense.

Thanks, JayMan!

I suspect that all of the Citrix stuff uses HTTPS, so you should try unchecking 'SSL Scanning' in your Exception.

In fact, I just checked and confirmed that I've used GoToMeeting behind a UTM with full decrypt and scan and no Exceptions for GoToMeeting or Citrix, so I'm a bit confused by your experience.

Cheers - Bob

Bob here is something to really boggle your mind.

If I make an exception that has no categories or anything but coming from a AD group it works without issues. As soon as I put in the categories the issue comes up almost as if some URL I am missing that isnt showing up is in some other category. BUT if I check off all the categories it still doesn't work.

plz try the following

visit gotomeeting support page

1. Create SSL exceptions in web filtering for the Citrix domains.

2. Create the 17 citrix ip blocks from website above and add them in 'Skip Transparent mode Desination Hosts /Nets'

3. Create firewall to these 17 Citrix IP blocks , allowing ports http,https, 1853,8200. (need to apply MASQ on the target PC/devices )

In essence, you want to tell the web filter, for citrix IP range, do not use web filtering engine , use firewall rule.

I have been also struggling with more or less similar problems. I believe somehow the https scanning is breaking the gotomeeting packets.I wanted to apply a similar work around with SOCKS, just like with Skype but you cannot specify proxy settings for the app. Hope that this may be helpful.