Whiteboard, Polls, Q&A and Powerpoint not working over Federation

Question

Hi,
I have a problem with whiteboard, polls, Q&A and Powerpoint sharing over federation, if the federated endpoint is behind a web proxy with HTTPS inspection enabled. Audio, video and desktop sharing works fine.
Scenario:
2 Domains which are federated (DomainA and DomainB), all Lync servers are full patched (June 2014)
2 Users (UserA from DomainA and UserB from DomainB) works with full patched Lync Client 2013. Both Users work on their internal LAN. The client cannot reach the internet directly. Web requests go to through a proxy with HTTPS inspection.
1. UserA starts a Chat with UserB. UserB accepts.
2. UserA adds the whiteboard. UserB gets the "Add meeting content" button and accept.
3. UserA gets the whiteboard, UserB gets a error message "Because of network issues..."
In this scenario, UserB's Lync client tries to connect to WebConf Edge of DomainA over TCP/443 (HTTPS). Because UserB cannot reach the Internet directly from the inside LAN, the request goes trought the web proxy of DomainB (ProxyB). The web proxy is configured
with https inspection, so on the WebConfEdge I get requests from the web proxy of DomainB which are also answered by the WebConf Edge. On the pc of UserB I also get the answer, but signed with a certificate of the web proxy which is added as trusted root certificate
(normal behaviour if https inspection es enabled). On the network trace, as I can see, UserB resets (ACK, RESET) the connection to WebConf Edge directly after receiving the first https response.
Then I changed the web proxy (ProxyB) to bypass the https inspection for the ip address of the WebConf Edge of DomainA. The same scenario works fine now. It always works fine, if UserB have directly access to web conf edge of Domain A (UserB is in the internet
and not in the LAN).
I also could check this vice versa. It depends on which side, the conferencing is hosted. As soon as the other user connects through a web proxy which doesn't bypass the request directly, the user do not get the web conf content.
Then I tried with other domains and other environments, but all of them had the same issue, as long as the web request from the foreign user goes throug a web proxy. It seems there is no dependency on which product of web proxy will be used, it seems to
be a dependency on https inspection and all changes the web proxy do in this case with a web request and response.
I always tested with whiteboard, but the same behaviour is with Q&A and polls and also with Powerpoint (WAC). For Powerpoint it's only because the foreign user do not get the URL from web conf, so the client do not know how to connect to the WAC of DomainA.
During the tests with several Domains (customers), I see a corrupt "Client Hello" from a specific web proxy. In the list of cipher suites in the "Client Hello", the web proxy added an additional byte (0xFF) at the last TLSCipherSuites
entry, so the extensions, followed by the ciphersuites list in the "Client Hello" are not readable. So the connection will be reseted directly.
Because my workaround depends on the web proxy of the foreign side (configure bypass) it's not really a practicable way to make sure, the web conferencing content will work. Is there an other way to solve this issue?
Regards, Stephan

Answer 1

Hi,
From your description, the issue should be the
https inspection on the web proxy, maybe you should change from the web proxy side.
You can refer to the link of
Enabling HTTPS Inspection causes some applications to stop working
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or
information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support