Endpoint client on VPN kills Office 365 Outlook/Skype.

[Jason_Dance]

Hello fellow Checkmates.

I have a situation that I'm in a quandary about what to do.

I currently have an environment with R80.10 Management, R77.30 gateways, and separate R77.30.03 Endpoint Management with E80.80 Endpoint clients.  Our fleet has a combination of Windows 7 and 10 (1607) machines.

We use the VPN and Firewall features on our endpoints (Application control is automatically selected because Firewall is selected).  Hub mode is not selected, so only 'interesting' traffic matching the subnets added to the group I created for the Remote Access VPN domain is routed over the client VPN.  I have the default firewall policy set to the following:

Since migrating to Office 365, my users have had many challenges with using Outlook and Skype for Business while they are connected with VPN.  The clients lock up/crash until the user disconnects the VPN, then Outlook/Skype works fine.

I have worked with the TAC in the past, but was not able to put anything effective in place to mitigate these issues.

Aside from upgrading everything to R80.20 (which we will do when the product has a few general takes under its belt), what else could the community suggest I look at?

[Duane_Toler · Accepted solution]

I just suffered through this.  Check your malware DNS trap in the Threat Prevention profile (or per gateway, if you're doing that).  I found my customer's clients were querying "wpad.<their domain>" and somehow that was being trapped by the AV/AB blade as malware and returning the IP of the DNS trap I had configured (192.0.2.255 in my case).  Then that traffic was being blocked.

This affected only Windows 7 clients and not Windows 10 for some reason.  No idea why.

I disabled the Malware DNS Trap for now since I had about 850 users coming at me with pitchforks. 

Good luck on your problem resolution!

[Jason_Dance]

Thanks Duane Toler‌, I'll give it a go now.

[Jason_Dance]

Thanks again for that suggestion Duane.  I actually disabled the wpad setting in IE on the affected clients, and it resolved the issue.