Webfilter with SSL Inspection blocking Audio and Video in Google Hangouts

[ptech]

We're using a 600D, version 5.4.1 and we have a new network segment we are moving some users to. This network is somewhat restricted on content so we enabled the webfilter and are blocking a good bit of stuff. We turned on the SSL inspection with the "Certificate Inspection" profile which is supposed to be a nice light touch and not get in the way with certificate warnings. The main issues is our users communicate with Google Hangouts and make audio/video calls with it frequently. The text side of hangouts is working fine however when making calls, the call will connect but never pass audio/video through. I thought there might be a web filter category blocking that aspect so I stated unblocking items. I got very drastic and ended up unblocking EVERYTHING, but the audio/video never goes through until we turn off SSL certificate inspection. With certificate inspection turned off audio/video is working again. We're now back to the original setting with the category filters on but the ssl inspection off. This is not ideal because most user are smart enough to know to use https when they get blocked.

[hmtay_FTNT]

Hello ptech,

This might be unrelated to the Certificate Inspection. Google Hangouts Video calls require you to whitelist the STUN protocol too. Is that signature set to Monitor/Allow in your policy?

If you can get me a packet capture, I can look into it and find out what's wrong for you. Thanks!

Homing

[ptech]

Ok, so this may in fact not be a webfilter question. So currently that network is only allowed to connect out on http, https, and ping. What service should be added to allow the Hangouts audio/video communication? I looked up STUN but it was not listed in the services and I have not found much info online about how to go about unblocking it. Is there another service such as SIP that should be allowed?

[ptech]

Ok, most info I'm digging up involves UDP ports 19302-19309 and TCP ports 19305-19309. I will try this after hours today and see if that fixes it.

[anelis]

Hi there, here's some support doc on google's sites: https://support.google.com/a/answer/1279090?hl=en

From what I know, Hangout will firstly try to use the UDP port ranges, fallback to the TCP onces and as a last resort use http and https. Using UDP ensures the less latency on video and audio calls so you should open those at least.

Also I know that Hangout has issues with explicit proxies, this might explain why it doesn't work when you enable SSL Certificate inspection as your firewall might be in "proxy mode".

So I would try this setup:

Keep the SSL certificate inspection & the web filtering;

Open at least the UDP ranges;

In this case, Hangout won't default to the http or https protocols to communicate and will use the fastest way which is through the UDP protocol.

It's an interesting case though.