topic Re: Skype for Business problem after migrating from ASA to PA-820 in General Topics

Skype for Business problem after migrating from ASA to PA-820

Radmin_85 — Wed, 20 Jun 2018 19:45:16 GMT

We  encountered with the problem of Skype for Business application , it needs to say
that all another applications are working well, but after migration from Cisco ASA to
PA-820 we  saw only tcp-rst-from-server message from remote server to local server for
Skype or for clients too without of local server... no matter what..  it's very
strange behaviour , as soon as we put again Cisco ASA in the place back , all starting
working fine..

Re: Skype for Business problem after migrating from ASA to PA-820

OtakarKlier — Wed, 20 Jun 2018 20:40:18 GMT

Hello,

Skype is a major pain. What we found is that it needs a lot of apps and even some on non-standard ports.

That is what we have setup from external to our internal edge/arr servers.

Hope that helps.

Re: Skype for Business problem after migrating from ASA to PA-820

Radmin_85 — Wed, 20 Jun 2018 21:11:46 GMT

Do we need allow these apps and services from outside to inside traffic?

Re: Skype for Business problem after migrating from ASA to PA-820

OtakarKlier — Wed, 20 Jun 2018 22:10:27 GMT

Honestly it depends on where you are allowing traffic to/from. However this is what we found to allow federation to other companies lync/skyp servers.

https://support.starleaf.com/managing/cloud/firewall-and-bandwidth-information/firewall-configuration-for-skype-for-businesslync/

Re: Skype for Business problem after migrating from ASA to PA-820

Radmin_85 — Fri, 22 Jun 2018 17:04:07 GMT

But we have allow any any rules.

So i guess allow any any must work in such situation

Re: Skype for Business problem after migrating from ASA to PA-820

OtakarKlier — Fri, 22 Jun 2018 17:34:47 GMT

Hello,

What we found was that some of hte applications were using non standard ports. So on your any any rules, make sure to set the Service to ANY as well instead of hte Application-Default'

Regards,

Re: Skype for Business problem after migrating from ASA to PA-820

Radmin_85 — Thu, 28 Jun 2018 08:24:02 GMT

yes we did it

it is any any

Re: Skype for Business problem after migrating from ASA to PA-820

Remo — Sun, 01 Jul 2018 19:48:15 GMT

@Radmin_85

Was this ASA to PA migration a 1:1 migration or are there little topoligy / routingchanges? The skype telated DNS entries are also sometimes leading to problems. For example some time ago I was troubleshooting a situation where skype calls/conferences to external partners simpliy did not work and as always everyone thought the firewall is the problem ... till we found a wrong DNS entrie which made the clients in the internal network think they are external, so skype was trying to connect to the external IP of the skype edge server where the result was the connection did not work ... after the DNS entry was deleted (this one should only be available from external) everything was working fine ...

Re: Skype for Business problem after migrating from ASA to PA-820

RobinClayton — Mon, 02 Jul 2018 08:05:24 GMT

Skype for business in my opinion, is not fit for purpose. It may be fine in a small business that does not care about securoity and allows any old connection in and out. But in this modern world of security it requires so many services, ports, kludges and workarounds that it makes it unreliable and insecure.

Microsoft need to tidy it all up.

We just about have it working now.

Rob