topic Re: Skype for Business not work if use SSL Decrypt in General Topics

Skype for Business not work if use SSL Decrypt

ToniE — Fri, 16 Feb 2018 14:00:52 GMT

Hi,

Is it possible to exclude Skype for Business application from SSL Decrypt?

Custom No decrypt URL category is not an option because new clients with on-premises Skype instances coming constantly.

Toni

Re: Skype for Business not work if use SSL Decrypt

BPry — Fri, 16 Feb 2018 15:07:04 GMT

@ToniE,

You aren't able to exclude specific applications from SSL-Decryption. Your only option is either going to be custom URL categories or excluding the on-site server IP addresses from decryption.

Re: Skype for Business not work if use SSL Decrypt

OtakarKlier — Fri, 16 Feb 2018 16:20:11 GMT

Hello @ToniE,

We also have this issue. Our solution was to instruct the users to use the web version of the conference if the conference was hosted by a 3rd party. We then had to exclude the Lync/Skype applications from URL filtering since not everyone has dns extries and sometimes they have just IP's.

Hope that helps.

Re: Skype for Business not work if use SSL Decrypt

Remo — Sat, 17 Feb 2018 22:12:14 GMT

Hi @ToniE

Actually there is an option to exclude an application form TLS decryption ... ok, it is a creative workaround to achieve that goal but this solution here should work also in your case: https://live.paloaltonetworks.com/t5/Community-Blog/How-to-bypass-SSL-decryption-for-an-application/ba-p/170752

Instead of the application in the article, you have to use ms-lync-base and/or ms-lync-online. There probably the first connection attemt still fails as the firewall will add the IP after this attempt to that dynamic group, but it is a solution that could save you a lot of work and complaints from customers.

Regards,

Remo

Edit: Of course only if the security policies of your company allow such a dynamic TLS decryption exclusion, cause this will add the risk of not decrypting misidentified connections. And thepotential risk that this configuration could be exploited to send data out of your network without decryption

Re: Skype for Business not work if use SSL Decrypt

AndyYerger — Sat, 17 Feb 2018 22:57:19 GMT

Re: Skype for Business not work if use SSL Decrypt

AndyYerger — Sat, 17 Feb 2018 22:59:43 GMT

Try adding tose to your custom url then add that to no decrypt. I got it working by doing this.

Andy

Re: Skype for Business not work if use SSL Decrypt

ToniE — Mon, 19 Feb 2018 08:26:53 GMT

Hello Remo,

Thanks for workaround. We have to think best solution.

Toni