MSS FW Best Practices: Zoom & Teams

CAUTION: These documents are intended to provide partners with firewall configuration recommendations ONLY. They contain examples and caution should be exercised when making changes to your firewall as unplanned changed could result in downtime based on the complexity of the environment and/or configuration. 

MSS Recomended SonicWall Firewall Best Practices Index

Notes/Considerations

• SonicWalls will interfere with Zoom & Teams traffic by default due to the nature of UDP VoIP traffic.
• If the SonicWall has UDP Flood Protection enabled, you might need to increase the UDP Flood Attack Threshold (UDP Packets / Sec) if the firewall is seeing the VoIP traffic as an UDP flood.

Excluding Services

1. Create a Service Object Group with all of the ports that are used by the Zoom and/or Teams service the customer has, Phone, meeting, etc. The lists can be found here:
   1. Zoom: Network firewall or proxy server settings for Zoom – Zoom Help Center
   2. Teams:
      1. Prepare your organization's network for Teams - Microsoft Teams | Microsoft Docs
      2. Implement Quality of Service in Microsoft Teams - Microsoft Teams | Microsoft Learn
2. Create an outbound firewall rule from the zone where the zoom/teams clients are to the WAN with the following settings:
   1. Service: Service port group created above
   2. TCP Connection Inactivity Timeout (minutes): 30
   3. UDP Connection Inactivity Timeout (minutes): 60
   4. Allow TCP Urgent Packets
   5. Disable DPI
   6. Disable DPI-SSL Client
   7. Disable DPI-SSL Server

If the customer is running DPI-SSL:

1. Exclude the service object group created above.

2. Exclude the Zoom Layer 7 application from the firewall’s DPI engine:
   1. Create a Match Object for Zoom and/or teams:

2. Create an App rule to bypass DPI:

Additional Configuration

In addition, implement the SonicWall recommended changes to the Flood Protection and App firewall per the following KB: Troubleshooting dropouts for video conferencing applications | SonicWall

1. Ensure the following applications are not blocked in the App Control:
   1. Encrypted Key Exchange
   2. Non-SSL traffic over SSL port