Configure Webex Meeting Access in SWG

Introduction

This document describes accessing WebEx when using the Umbrella Secure Web Gateway (SWG).

Background

Cisco Webex Meeting is a web conferencing app which can have problems running on SWG depending on your Umbrella policy settings. Issues such as audio connection problems can occur. This article covers how Umbrella must be configured. 

Note: The domains and IP addresses (CIDR ranges) used by Webex are dynamic and can change without notice.

The current list of domains used by Webex can be found here:

https://help.webex.com/en-us/article/WBX000028782/Network-Requirements-for-Webex-Services#id_135010

The current list of CIDR ranges used by Webex can be found here:

https://help.webex.com/en-us/article/WBX000028782/Network-Requirements-for-Webex-Services#id_135011

NEW - Online Meetings Category 

Umbrella now categorizes the IP addresses associated with Webex as 'Online Meetings' category. To allow webex meeting audio via policy customers can simply allow the 'Online Meetings' category.

For further manual configuration options continue reading this article.

Manual Configuration

• Recommended - Bypass Webex:
  • In the Umbrella dashboard --> Deployments --> Domain Management --> External Domains & IPs, add all Webex-related domains and IP address ranges
  • If using Cloud Delivered Firewall (CDFW) feature, exempt the traffic related to Webex domains and IP addresses from entering the tunnels on your IPsec device.

Webex cannot function when this traffic is decrypted.  Furthermore, with the latency sensitive nature of Webex traffic, it is not recommended to proxy this traffic with SWG.

The attached files cidr_webex.csv and domains_webex.csv contain the Webex-related CIDR ranges and domain names as of April 2022, and can be uploaded into Umbrella.

• Minimum - Allow Webex via Policy: 
  • Add the IPs and domains for Webex to a relevant Umbrella "Allow" Destination List
  • Add the Webex-related domains to a Selective Decryption List to ensure this traffic is not decrypted.  (IP addresses by default are not decrypted and do not need to be added.)

What about using Application Settings to allow Webex?  

Umbrella Application Settings works using domains only; it is unable to handle or process IP addresses.  As a result, it is unable to control the IP addresses used by Webex.