Spotify not working through Ironport S370

[neilcouston]

We are trying to get Spotify to work through our Ironport S370 which is configured for both HTTP and HTTPS proxy.

Spotify allows you to set a HTTPS proxy which we have done but we continually get a 112 error which is a Spotify error meaning no connection (Check firewalls and proxies)

We have created an Identity and decrption policy just for one user and all catagories are set to pass-through but this does not work. Does anyone have any ideas what we need to do to get this working as it is causing major issues to the education music department.

Many thanks,

Neil

[alexdelangel]

Hi neil,

I hope you are doing well. Are you using transparent redirection on the ASA? Or just explicit proxy configuration? 

Since Spotify allows you to set an HTTPS proxy (like an explicit redirection to Ironport), and then if the ASA is running WCCP process, the traffic will be redirected to Ironport (again), and maybe you are creating a loop.

The pass-through that you configured on the decryption policy is OK, because the spotify HTTPS requests are matched by the Streaming Audio, and Entertainment categories.

Would you check these details and report back? In the case it did not work, would you share some accesslogs output? Feel free to request assistance in the case you do not know how to get accesslogs.

I am not an expert, but I currently have the opposite issue. I want to block spotify!!!!! Would you share with me, how you get spotify blocked?

Regards

Alex,

[AG]

Hi,

Are there any news how this can be solved? I have the same problem. Spotify.com is set as HTTPS pass-through in the Custom URL Category, but does not work. 

The Policy Trace shows, that the connection is allowed, but is does not work.

Any idea? Thanks.

Regards,

Andrej

[AG]

Hi,

And just to add this... I have just HTTP 200 repy codes in my grep (didn´t paste the whole output). The Website is working fine, just when you would like to play music, this istn´t working.

1427450528.769 268 10.22.8.111 TCP_MISS_SSL/200
1427450529.313 82 10.22.8.111 TCP_MISS_SSL/200 
1427450529.829 42 10.22.8.111 TCP_MISS_SSL/204 
1427450529.833 93 10.22.8.111 TCP_MISS_SSL/200 
1427450530.022 328 10.22.8.111 TCP_MISS_SSL/200
1427450530.071 230 10.22.8.111 TCP_MISS_SSL/200
1427450531.919 82 10.22.8.111 TCP_MISS_SSL/200 
1427450531.922 41 10.22.8.111 TCP_MISS_SSL/204 
1427450532.041 311 10.22.8.111 TCP_MISS_SSL/200
1427450532.103 237 10.22.8.111 TCP_MISS_SSL/200
1427450532.145 96 10.22.8.111 TCP_MISS_SSL/200 
1427450532.340 266 10.22.8.111 TCP_MISS_SSL/200
1427450532.609 191 10.22.8.111 TCP_MISS_SSL/302

Regards,

[AG]

Problem solved... I opened the TCP Port 1935 on the firewall (Adobe Systems Macromedia Flash Real Time Messaging Protocol (RTMP) ). No other setup was made...

[Handy Putra]

Spotify traffics are using using port 80 and 443 however it will then switch to port 4070 for their subnets of 192.182.8.0/24, therefore in WSA will need to have the option of "permit tunnelling of non-http requests on http ports to be enabled.

If you have the above setting to be disabled, most likely Spotify would allow the login to occur however nothing would load such as spottily radio, etc.

You can enable this setting from the CLI of WSA by using command of advanceproxyconfig -> miscellaneous -> keep pressing enter till reach section of "Would you like to permit tunneling of non-http requests on http ports?" and set it to allow, also on the section of "Would you like to block tunneling of non-SSL transactions on SSL Ports?", set it to 'N'

Then keep pressing enter till you reach initial prompt and type in 'commit' to save your changes.

Also make sure that port 4070 is not block by your Firewall.

[AG]

Is this not a security risk if you enable this feature?

In my wireshark captures I can not see any connection to the port 4070. 

[spotifiology]

It sounds like you're experiencing difficulties getting Spotify to work through your IronPort S370 with HTTPS proxy configured. The 112 error indicates a connection issue related to firewalls or proxies.

Here are a few steps and considerations you might find helpful:

1. Proxy Configuration: Double-check the HTTPS proxy settings configured in Spotify to ensure they match the settings on your IronPort S370.

2. Firewall and Proxy Settings: Verify that the firewall rules and proxy settings on the IronPort S370 allow Spotify traffic. Ensure that Spotify's domains or URLs are not being blocked unintentionally.

3. Identity and Decryption Policy: Since you've created a policy for pass-through, ensure it encompasses all necessary configurations for Spotify traffic. Review and adjust any restrictions that might affect Spotify's connection.

4. Testing and Troubleshooting: Conduct thorough testing by monitoring network traffic logs on the IronPort S370 to identify where the connection is failing. Check for any logs or alerts that indicate blocked traffic.

5. Cisco Support: If the issue persists, consider reaching out to Cisco support for specific troubleshooting steps and guidance tailored to your IronPort S370 configuration.

I hope these suggestions help resolve the issue and minimize disruptions to the education music department. Please let us know if you need further assistance or if there are any updates.

Best regards,