Skip to main content
ptech
ptech
New Member
November 1, 2017
Question

Webfilter with SSL Inspection blocking Audio and Video in Google Hangouts

  • November 1, 2017
  • 1 reply
  • 17172 views

We're using a 600D, version 5.4.1 and we have a new network segment we are moving some users to. This network is somewhat restricted on content so we enabled the webfilter and are blocking a good bit of stuff. We turned on the SSL inspection with the "Certificate Inspection" profile which is supposed to be a nice light touch and not get in the way with certificate warnings. The main issues is our users communicate with Google Hangouts and make audio/video calls with it frequently. The text side of hangouts is working fine however when making calls, the call will connect but never pass audio/video through. I thought there might be a web filter category blocking that aspect so I stated unblocking items. I got very drastic and ended up unblocking EVERYTHING, but the audio/video never goes through until we turn off SSL certificate inspection. With certificate inspection turned off audio/video is working again. We're now back to the original setting with the category filters on but the ssl inspection off. This is not ideal because most user are smart enough to know to use https when they get blocked.

    1 reply

    hmtay_FTNT
    Staff
    hmtay_FTNT
    Staff
    November 2, 2017

    Hello ptech,

     

    This might be unrelated to the Certificate Inspection. Google Hangouts Video calls require you to whitelist the STUN protocol too. Is that signature set to Monitor/Allow in your policy?

     

    If you can get me a packet capture, I can look into it and find out what's wrong for you. Thanks!

     

    Homing

    ptech
    ptechAuthor
    New Member
    November 2, 2017

    Ok, so this may in fact not be a webfilter question. So currently that network is only allowed to connect out on http, https, and ping. What service should be added to allow the Hangouts audio/video communication? I looked up STUN but it was not listed in the services and I have not found much info online about how to go about unblocking it. Is there another service such as SIP that should be allowed?

    Terms & ConditionsAccessibility statement