IE Slowness for Webmail

[Arjun_Sawant]

Hi,

We are using office365 for mailing and have already registered with Microsoft for security stuffs like malware, spam and others. In checkpoint we are using Anti-Ransomware, Anti-bot and TE.

We are facing IE slowness/crash for webmail, we have exlcude the below domains in TE.

outlook.office.com

outlook.office365.com ....but still having same issue.

Requirement is;

1. Webmail should not scan by sandblast (Checkpoint any blade)

2. How can we confirm/verify the webmail webpage is scan by sandblast?

Thanx

[PhoneBoy]

Plenty of customers use SandBlast Agent with Office365 precisely because Microsoft doesn't block enough on it's own (even when you sign up for their extra security services).

Also, it's not likely that this is the cause of your issues since:

• Anti-Bot blocks access to known Command and Control sites (which Office365 clearly is not)
• Threat Emulation only activates when you download attachments
• Anti-Ransomware is relevant when code executes from EXEs or similar

I recommend opening a TAC case so we can properly troubleshoot what's going on.

[Nüüül]

Do you:

..see any Log messages in SmartLog regarding this or other blocked connections?

..have HTTPS Inspection enabled?

..have Performance Impacts on other sites (i.e. some other from Office 365 and completely different)?

..have any Problems with Using /Activation of Word/Excel and so on?

..any other web mailer?

How is the firewall/Clients configured? with Proxy? ist the Firewall the proxy?

You disabled TE for just the two DNS A Records outlook.office.com and outlook.office365.com? How did you configure this?

Daniel

[Arjun_Sawant]

Hi,

Thanx for update..

For your information;

.see any Log messages in SmartLog regarding this or other blocked connections?

.....There is no any blocked connections.

..have HTTPS Inspection enabled?

....No.

..have Performance Impacts on other sites (i.e. some other from Office 365 and completely different)?

.....There is no issue for other websites.

..have any Problems with Using /Activation of Word/Excel and so on?

.....How can we check on that?

..any other web mailer?

 ....NO

How is the firewall/Clients configured? with Proxy? ist the Firewall the proxy?

......Firewall is not configured as proxy, we have separate appliance for proxy.

You disabled TE for just the two DNS A Records outlook.office.com and outlook.office365.com? How did you configure this?

We have exclude outlook.office.com and outlook.office365.com in TE. In,

SandBlast Agent Threat Extraction and Emulation settings for the entire organization  ---> Inspect all domains and files

How can we check/verify whether webmail webpage is scanning by sandblast or not? Any debug?

We have verified that by uninstalling sandblast agent, webmail work perfectly fine, so we need to completely bypass webmail in sandblast.

.

Thanx

Arjun

[PhoneBoy]

As I suggested previously, I recommend opening a TAC case so we can troubleshoot what's going on.

Contact Support | Check Point Software 

[Arjun_Sawant]

Already opened.. It's pending with development team for long time

On Tue 31 Jul, 2018, 10:27 PM Dameon Welch Abernathy, <

[PhoneBoy]

Will need the SR# privately so I can investigate what's going on.

[Arjun_Sawant]

Hi,

Service Request # 3-0395040181

[PhoneBoy]

I've escalated the ticket, hopefully we'll see some movement soon.

[Arjun_Sawant]

Thanx a lot..

On Wed 1 Aug, 2018, 9:42 PM Dameon Welch Abernathy, <

[Hugo_vd_Kooij]

As far as exceptions go you may need to have a heavy list there for all various components of Office365.

EXchange Online for example should be:

"*.mail.protection.outlook.com","*.outlook.com","*.outlook.office.com","*.protection.outlook.com","*.store.core.windows.net","*.um.outlook.com","asl.configure.office.com","autodiscover-*.outlook.com","domains.live.com","mshrcstorageprod.blob.core.windows.net","outlook.office365.com","r1.res.office365.com","r3.res.office365.com","r4.res.office365.com","smtp.office365.com","tds.configure.office.com","xsi.outlook.com"

Another reason for bad performance issues:

DNS

Either a bad or slow DNS server will kill your Office365 performance. I have seens several issues whenre the customer was using google as DNS and it was sending Office365 to a US datacenter instead of a EU datacenter. That will give you a poor latency and hence a poor experience.

[Arjun_Sawant]

Is it require to all exclude?

Also how can we verify that webmail webpage is not scanning by Sandblast?

On Thu 2 Aug, 2018, 6:49 PM Hugo van der Kooij, <donotreply@checkpoint.com>

[Chinmaya_Naik]

Dear Sir,

As we see the issue when we install the client package on the windows machine.

The important things are that when we install package, google chrome is working perfectly even we access webmail.

but the only issue with IE the fact is that on both browsers sandblast agent is working.

Webmail (O365)we able to access but its too slow and because of more slowness most of the time explorer is crash.