Umbrella and Canon Uniflow

[likvid]

We are moving from Zscaler to Umbrella and use Canon Uniflow for the printers.

The printers worked fine before Umbrella but can not print anymore since moving to Umbrella.

There is only default policy enabled for the tunnels from sdwan routers to Umbrella cloud.

I tried to connect a laptop to the printer network and tried to connect to port 443 URLs in Canon cloud, it worked but the printers can't print, we tried to hard reset the printer to no availability.

Only thing changed really when moving from Zscaler to Umbrella is the source IP, however Canon does not use any white or blacklisting on their side.

Anyone had this problem?

[Ken Stieers]

Are you using SIG?
If so, are you decrypting HTTPS traffic? You may need to exempt Canon's website from decryption since its typically hard/impossible to add the Umbrella root cert to the printers.



________________________________

This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this communication in error, please immediately notify us by telephone and return the original message to us at the listed email address.
Thank You.

[likvid]

Yes i am using SIG.

I have disabled HTTPS inspection and Intelligent Proxy

I have done pcap and examined the TLS flow and the client sends a Client Hello but doesn't get a Server Hello back.

[Ken Stieers]

Ask Canon if they have limit to where connections can come from... if they're expecting your IPs, or Zscaler's they may block because now you come from Umbrellas...

Or you can add the domain in question to the "just ignore Umbrella altogether" list under Deployments>Configuration>Domains>External Domains & IPs

________________________________

This email is intended solely for the use of the individual to whom it is addressed and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law. If the reader of this email is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited.
If you have received this communication in error, please immediately notify us by telephone and return the original message to us at the listed email address.
Thank You.

[likvid]

We had to revert back to Zscaler, talked to Canon and they don't have any whitelisting.

TLS handshake fails with Umbrella but works perfectly with Zscaler, Umbrella is such messy product that we might go on with Zscaler if this doesn't work out.

There is a TAC case with Cisco now.

[adamwin]

@likvid I'll take a look at that ticket. We'll get this sorted out for you.