Xbox update not going through Ironport WSA

[m.glosson]

We have been having a terrible time trying to get the new Xbox 360 update program to go through the WSA. The WSA is utilizing WCCP in tandem with the ASA firewall.

For testing we put denies on the WCCP access list so the Xboxes go directly to the Internet, and it works fine. But this is a college there are literally hundreds of Xboxes. Certainly there are workarounds (every student registers their Xbox's MAC address and we make 100 DHCP reservations that bypass WCCP) but the workarounds are no fun.

Has anybody seen this issue and worked through it?

[Ken Stieers]

We saw similar issues with Win8/8.1

Grep the access logs when it hits the wsa, put the domain names it hits in a custom category and setting that category to NOT be decrypted and not to require authentication.

[Atazazuddin Shaikh]

Hello

Thanks for  reaching out,  Xbox live by default uses UDP ports 88 and 3074 as well as TCP port 3074, in order to verify it,  Please have a client ip in the WCCP re-direct list and take a capture plus gather accesslogs to see what ports. and http/https response you received while it fails.  This will give us more details as to why the access is failing through the WSA Appliance.

Regards,

Zack

[Laird Thornton]

Small university here:

Our solution was to enable RangeRequestDownloads.  

run "rangerequestdownload" from CLI and "y" to enable.  

This allowed both Xbox, PS4, and smartTV's to access the internet, download games/apps, and allow for onling gaming.  

Not sure if it meets your security requirements, but it has worked for our needs.