Skype for Business New IPs Needed For SSL Decryption

[CarlFrey]

 Looks like there are some new IP addresses that need to be accounted for Skype for Business to work w/ SSL Decryption enabled.

Here is the MS link plus some of their verbiage, https://techcommunity.microsoft.com/t5/Skype-for-Business-Blog/Updated-IP-ranges-and-ports-for-Skype...

• New IP ranges: We already started to move the Skype for Business infrastructure to the following ranges. However, remember to open all IP ranges documented in Office 365 URLs and IP address ranges.
  • 13.107.64.0/18

  • 52.112.0.0/14

• New ports: While this might take a little bit more time than the new IP ranges, we will leverage the following ports for media traffic in addition to the existing ports:
  • UDP 3479
  • UDP 3480
  • UDP 3481

A similar topic came up previously at the below link. 

https://live.paloaltonetworks.com/t5/General-Topics/No-SSL-Decrypt-Skype-for-Business-traffic/m-p/13...

I added the two ranges to not be decrypted and users were able to successfully authenticate to Skype thereafter. I saw in the normal monitored traffic tab that traffic was being permitted but nothing was super obvious that it was a SSL Decrypt issue. Hope this helps others out.