{"id":4268,"date":"2020-06-29T08:37:37","date_gmt":"2020-06-29T06:37:37","guid":{"rendered":"https:\/\/www.msb365.blog\/?p=4268"},"modified":"2023-06-23T13:03:08","modified_gmt":"2023-06-23T11:03:08","slug":"sophos-astaro-office-fail","status":"publish","type":"post","link":"https:\/\/www.msb365.blog\/?p=4268","title":{"rendered":"Office 365 Ports and Firewall Challenges"},"content":{"rendered":"

In this article I would like to talk about the deployment of Office 365.
\nWe can prepare, automate, customize, etc. a lot in our Microsoft Admin Portals.<\/p>\n

Nevertheless, it happens again and again that parts of the service do not work. My experience has shown me that in more than 90% of the cases, one of these 2 points was responsible.<\/p>\n

 <\/p>\n

Firewall exceptions<\/h3>\n

During one of my last installations we deployed Microsoft 365 via autopilot. This basically worked very well. Only the office package could not be installed.<\/p>\n

In another case, the Office applications were already installed, but could not be updated.<\/p>\n

Both customers had one general thing in common. This was the used firewall. In this case we are talking about Sophos Astaro UTM.
\nI am not saying that this problem can only occur with a Sophos UTM firewalls, but in my example I am using that firewall.<\/p>\n

The reason why Office could not be installed is that the firewall requires an exception.
\nHere is how this can be done:<\/p>\n\n\n\n\n\n\n\n
\"\"<\/a><\/td>\nWe logged on to the Sophos Firewall.<\/td>\n<\/tr>\n
\"\"<\/a><\/td>\nAfter the successful logon we browse to:<\/p>\n

Web Protection<\/strong> > Filtering Options<\/strong><\/td>\n<\/tr>\n

\"\"<\/a><\/td>\nHere we click on<\/p>\n

+New Exeption List…<\/strong><\/td>\n<\/tr>\n

\"\"<\/a><\/td>\nThen we create a new exception according to the template in the picture.<\/p>\n

Of course, individual settings can be adjusted according to the infrastructure. But I recommend using this configuration whenever possible.<\/p>\n

The most important step is the “Target Zone”. Here we define the domains for which we want to do the excluding.<\/p>\n

In our case we need the following value:<\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

^https?:\/\/([A-Za-z0-9.-]*\\.)?officecdn\\.microsoft\\.com\\.edgesuite\\.net\/<\/strong><\/span><\/p>\n

 <\/p>\n

At the end confirm with Save<\/strong>, and the new exeption is ready.<\/td>\n<\/tr>\n

\"\"<\/a><\/td>\nThis is what the created exception will look like on Sophos.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Note: Please note that this is only an example with a Sophos Astaro Firewall. Other vendors with similar issues will have similar procedures. What matters most is the information that this must be taken and what value we must use to make it work.<\/p>\n

 <\/p>\n

General Firewall Ports<\/h3>\n

Another possible reason for service problems with Office 365 can be the classic firewall ports.
\nI have already described the ports for Exchange and Skype for Business in more detail in a previous article<\/a>.<\/p>\n

In this part of my blog article I would like to keep it a bit more general, but you will still recognize some entries in the following list:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Server\/Service<\/td>\nPort<\/td>\nProtocol<\/td>\nDirection<\/td>\n<\/tr>\n
ADFS\u00a0\u00a0 (Internal)<\/td>\n443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
ADFS (Proxy DMZ) or WAP Server<\/td>\n443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
Microsoft Online Portal (Website)<\/td>\n443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
Outlook Web Access (Website)<\/td>\n443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
Lync\/Skype for Business Client<\/td>\n443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
SharePoint Online (Website)<\/td>\n443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
Outlook for Mac<\/td>\n443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
Outlook Client<\/td>\n443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
Mail Routing<\/td>\n25<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
SMTP Relay (requires TLS)<\/td>\n587<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
Simple IMAP4 migration Tool<\/td>\n143\/993<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
POP3 (requires SSL)<\/td>\n995<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
DirSync\/Azure Active Directory Sync<\/td>\n80\/443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
Exchange Migration Tool<\/td>\n80\/443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
IMAP Migration Tool<\/td>\n80\/443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
Exchange Management Console<\/td>\n80\/443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
Exchange Management Shell<\/td>\n80\/443<\/td>\nTCP<\/td>\nInbound\/Outbound<\/td>\n<\/tr>\n
Lync (Data Sharing Sessions)<\/td>\n443<\/td>\nTCP<\/td>\nOutbound<\/td>\n<\/tr>\n
Lync (Video, Audio, Application Sharing)<\/td>\n443<\/td>\nTCP<\/td>\nOutbound<\/td>\n<\/tr>\n
Lync (Audio & Video)<\/td>\n3478<\/td>\nUDP<\/td>\nOutbound<\/td>\n<\/tr>\n
Lync (Audio & Video)<\/td>\n50000-59999<\/td>\nTCP\/UDP<\/td>\nOutbound<\/td>\n<\/tr>\n
Lync Mobile Push iOS Only<\/td>\n5223<\/td>\nTCP<\/td>\nOutbound<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Conclution<\/h3>\n

As mentioned at the beginning of this article, these two chapters in this article cover over 90% of the problems that occur when Office 365 installations or updates fail.
\nI hope this article has helped some of them.<\/p>\n

 <\/p>\n

Photo by Maud Bocquillod<\/a> on Unsplash<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

In this article I would like to talk about the deployment of Office 365. We can prepare, automate, customize, etc. a lot in our Microsoft Admin Portals. Nevertheless, it happens again and again that parts of the service do not work. My experience has shown me that in more than 90% of the cases, one […]<\/p>\n","protected":false},"author":1,"featured_media":4279,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1923],"tags":[],"class_list":["post-4268","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-365"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/4268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4268"}],"version-history":[{"count":7,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/4268\/revisions"}],"predecessor-version":[{"id":5173,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/posts\/4268\/revisions\/5173"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=\/wp\/v2\/media\/4279"}],"wp:attachment":[{"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msb365.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}