Skype for business content sharing R80.20 shows private IP destination in logs

[Sried]

Good Morning everyone,

i have experienced a weird behaviour in past weeks regarding skype for business and Cisco Any Connect.

Issue: Users trying to connect via CiscoAnyConnect or attend a skype meeting with shared content are unable to establish a connection.

Environment: R80.20 running one the gateways. Https Bypass set for all known Skype URLs .

Any Service allowed for all known Microsoft Skype Server IPs set in Application filter.

Behaviour: when i check the logs of the failed clients, i see a few packets to a valid microsoft server range (e.g. 52.112.0.0 /14). The traffic to this ip gets a rejext with message "First packet isn't SYN" 

Then i see a lot of packets trying to connect to a private 10.* range which is of course blocked in the firewall ruleset.

Did anybody experience the same problem?

With best regards

[PhoneBoy]

Is that IP range in your encryption domain at all?

[Sried]

Yeah, 

the IP range is part of our center gw encrytion domain.

[PhoneBoy]

Both the public and private IPs you mention?

[Sried · Accepted solution]

Hi,

only the private range is part of the encryption domain.

I recently made the changes described in sk162517 . Since then i was not able to see the problem again (last test yesterday).

I will keep monitoring this and send an update.

Thanks !