topic Re: Hangout as ms-lync in General Topics

Hangout as ms-lync

rjdahav163 — Thu, 18 Oct 2018 08:02:44 GMT

Hello everyone,

the users in our company use Google Hangouts / Meet. We allowed google-hangouts and google-meet and all the dependent applications with Service Any.

However the connection is recognized as ms-lync!!

Anyone else facing similar issue?

Best Regards,

Re: Hangout as ms-lync

BPry — Thu, 18 Oct 2018 16:50:49 GMT

@rjdahav163,

That seems kind of odd. Are you decrypting traffic at all or not?

Re: Hangout as ms-lync

rjdahav163 — Wed, 31 Oct 2018 14:45:36 GMT

@BPry

Nope.. Not at all...

Re: Hangout as ms-lync

BPry — Thu, 01 Nov 2018 18:00:36 GMT

@rjdahav163,

That's going to be the main cause of your issue. When the firewall can't see all of the traffic it can only look at certain parts of the signatures and can't reliably identify some applications. When not decrypting the way the ms-lync applications currently configured you'll see more false-positives. Google traffic is actually a fairly difficult thing to identify when you aren't decrypting any of the traffic.

What signature are you specifically seeing, ms-lync-audio or ms-lync-base?

Re: Hangout as ms-lync

rjdahav163 — Thu, 08 Nov 2018 09:45:53 GMT

Yeah.. decryption is not allowed for us. So that is a problem.

In the logs we just see ms-lync. No sub-application like ms-lync-base or -video.

Re: Hangout as ms-lync

BPry — Thu, 08 Nov 2018 14:54:27 GMT

@rjdahav163,

You can open a support ticket on the issue and hope that the next round of App-ID signature updates addreses the issue with a signature modifcation. Real issue with this however is that if you aren't decrypting (I get it, some environments simply can't do this for multiple reasons) the firewalls App-ID process really is a 'best effort' process.