topic allowing whatsapp through proxy in Web Security

allowing whatsapp through proxy

madhankumar.g — Sat, 30 Mar 2013 09:39:15 GMT

Hi,

We have Ironport S670 in our network for web filtering. Recently we migrated from forward mode to transparent mode to allow mobile applications to work through proxy.

Most of the applications started working such as skype and all. But still "Whatsapp" is not working through proxy.

Is there a way to allow or bypass to make this application work thorugh transparent proxy. Please suggest and let me know if any additional information is required. Thanks.

Regards,

Madhan kumar G

allowing whatsapp through proxy

Jai Koolwal — Sat, 06 Apr 2013 15:33:18 GMT

Hi Madhan!

We have come across this issue in the past and based on some tests we have the following information to share with you -

The WhatsApp application sends non-SSL data over SSL port 443. This causes the SSL handshake to fail between the server and the WSA.
In WhatsApp's case, the destination server does not return any error but just closes the WSA's 'Client Hello' (sent as a part of SSL handshake) and hence the WSA is unable to tunnel this transaction.
We have an existing Feature Request which aims to be able to process such traffic successfully through the WSA.
The details of the FR are # "CSCzv18663[Feature Request] Treat servers that RST our Client Hello as non-SSL"
Once this feature request is fulfilled, you should be able to get whatsapp running through the WSA!
If you want more details regarding this, please feel free to open a case with us!


HTH
Jai Koolwal
CSE, Cisco Systems

allowing whatsapp through proxy

madhankumar.g — Sun, 07 Apr 2013 06:27:15 GMT

Hi Jai Koolwal,

Thanks for the valuable input.

Regards,

Madhan kumar G

allowing whatsapp through proxy

Mustapha Arakji — Tue, 16 Jul 2013 15:17:44 GMT

is there any workaround until this FR is processed. Any expected date?

Regards,

allowing whatsapp through proxy

madhankumar.g — Wed, 17 Jul 2013 10:26:14 GMT

Hi Mustapha,

We are following below workaround temporarily.

Whatsapp initial connection is made on port 5222. This is not working through the IronPort. So, we configured destination port based NAT for the port 5222 in the firewall to allow lan subnets destined to this port where whatsapp is required.

So initial connection is made on 5222 without going through proxy and rest of the traffic goes on 443 via transparent proxy. This works and we are able to send texts, images, videos etc.

Regards,

Madhan kumar G

allowing whatsapp through proxy

Mustapha Arakji — Thu, 18 Jul 2013 05:38:55 GMT

Did NOT work with me! I have PBR on my ASA, forwarding only port 80 and 443 and I opened port 5222 for my clients, but that didn't work.

Regards,

allowing whatsapp through proxy

madhankumar.g — Thu, 18 Jul 2013 08:16:49 GMT

Hi Mustapha,

Your proxy is in Forward mode or Transparent mode?

Proxy needs to be in Transparent mode for this workaround to work.

Regards,

Madhan kumar G

allowing whatsapp through proxy

Mustapha Arakji — Mon, 22 Jul 2013 09:36:50 GMT

Hi,

My Proxy is in transparent mode !

Regards,

Re: allowing whatsapp through proxy

MRosemberg — Wed, 27 Nov 2013 11:36:43 GMT

Hi friends,

You don't need a transparent proxy. You need to open the port 5222 like SSL port.

Don't forget to open it in your firewall too.

Best regard's,

Hi Madhan Kumar,

Jaya Srinivas N — Mon, 23 Nov 2015 08:13:15 GMT

Hi Madhan Kumar, We too have the same issue. Can you please explain how you configured your firewall. We are using ASA 5550 firewall and IronPort S680 Web Security Appliance.

Hello Jai,

Bechara.abouraha — Tue, 12 Apr 2016 13:11:06 GMT

Hello Jai,

do you have any updates on this Feature Request?

Regards