I noticed an odd issue when both Business Central application
servers were running at the same time, in which the Azure Single Sign-on page
would constantly loop round and round after entering your credentials. If I
disabled IIS and stopped the Business Central Service Instance on one of the servers,
the issue went away.
In Azure, I noticed that the following setting was enabled on
the Production Application Gateway, but was disabled on Test. Under Settings
> Backend Settings > navServiceTierBackendHttpSettings > Cookie-based
affinity.
The application gateway
can use cookies to keep a user session on the same server. You can enable this
feature if the client supports the use of cookies.
I enabled Cookie Based affinity for the navServiceTierBackendHttpSettings
port 443 and this resolved the issue.
Due to the poor performance of my old POTS ADSL line, I decided to look at 4G Routers. Surprisingly, I could get over 200mbps download and around 50mbps upload!
Compared to my ADSL line of 17mbps down and 1mbps up, this significantly increased speed and performance!
I wanted to make use of my ADSL line, so I turned my Raspberry Pi into an OpenWrt router, and have it monitor both WAN connections.
If it detects the 4G connection is down by performing regular pings to 1.1.1.1, it will set the metric to a value of 1, and set the backup ADSL interface metric to 0.
The lowest value takes precedence, and the routing table is updated accordingly setting the default WAN interface to the ADSL interface. When the 4G interface comes back online the metric value is set back to 0, and the ADSL interface metric is set back to 1.
It works really well, and with OpenWrt, you can have many packages running that provide all sorts of extra functionality like Dynamic DNS updates, Private DNS, QOS and Bandwidth monitoring!
So I have a SQL PaaS Server in Azure, typically you connect to it using the server name which is a domain name that resolves to a public IP address. Now we have disabled public access, so we connect to it via a Private Endpoint.
Private Endpoints link the Azure Virtual Network (vnet), and our network config is done so the routing tables send the traffic to the correct location via SD-WAN etc. Connecting to the SQL Database is done via the server name, but that resolves to a public IP, which I can’t use, due to public access being disabled.
Enabling Private Endpoints creates this private DNS alias, if public access was still enabled then this alias would not exist. So in Azure, you can have Private DNS Zones which use Azure’s own DNS servers and services. We don’t use Private DNS for the virtual network in production, we use our own DNS servers in AD.
So by creating the zone in our DNS servers in AD, Azure will look at this zone and return the private IP I need of 10.X.X.X for sql-server.privatelink.database.windows.net. Now because it's an alias looking up the original server name will then eventually return my private IP.
The reason Microsoft does it this way is so if you wanted public access back again, Azure would add/remove this alias address providing you the correct IP you need.
Hope that helps.
For more information, see the original Microsoft community support post I made, along with a very useful video on Azure DNS in relation to Private Endpoints,
2.Extract the downloaded Policy File folder MicrosoftEdgePolicyTemplates.
Domain Controller Setup
3.Copy msedge.admx, msedgeupdate.admx and msedgewebview2.admx file
from C:\Users\{user}\Downloads\MicrosoftEdgePolicyTemplates\windows\admx to C:\Windows\PolicyDefinitions.
4.Copy msedge.adml, msedgeupdate.adml and msedgewebview2.adml file
from C:\Users\{user}\Downloads\MicrosoftEdgePolicyTemplates\windows\admx\en-US to C:\Windows\PolicyDefinitions\en-US.
5.Open Group Policy Editor.
6.Click User Configuration/Computer
Configuration > Administrative Templates > Microsoft Edge.
7.Double-click Configure Internet Explorer
integration.
8.Select Enabled.
9.Under Options, set
the drop-down value to Internet Explorer mode if
you want the sites to open in IE mode on Microsoft Edge
Configuring the Enterprise Mode
Site List policy
Configure IE
mode with a separate policy for Microsoft Edge. This additional policy allows
you to override the IE site list. For example, some organizations target the
production site list to all users. You can then deploy the pilot site list to a
small group of users using this policy.
1.Create or reuse a Site List.
2. Open
Group Policy Editor.
3.Click User Configuration/Computer
Configuration > Administrative Templates > Microsoft Edge.
4.Double-click Configure the Enterprise Mode
Site List.
5.Select Enabled.
6.Under Options, type
the location of the website list.
Our
PRTG server started alerting us to the following.
IP on DNS
blacklist (IP on DNS Blacklist) Down (Error checking bl.spamcop.net, it
contains an entry for 127.0.0.1)
Also,
emails sent from Office 365, some at not getting through.
watchdog.wmf.de
gave this error:
Decision Engine classified the mail item was rejected because of IP Block (from
outbound normal IP pools) -> 550 40.107.14.123 blacklisted at bl.spamcop.net
Appears bl.spamcop.net have
not renewed their domain?
Being someone who love playing around with Cisco kit I decided to annoy my wife and remove the standard cheap basic router from my ISP and go full enterprise at home!
The diagram below shows the topology of my setup, the broadband line uses a Fibre Line VDSL Broadband Fibre Connection. The main ISP router is a Cisco 887VA-M which has the firewall completely locked down with only ports 443 open for SSL VPN connection into my network. I gave the local interfaces an IP from the subnet of 192.168.2.X /30. This allows two IP addresses which can be used to connect the core ISP Cisco router to my Cisco ASA Firewall, which protects in the internal network.
The local LAN runs on a different subnet, 192.168.1.X /24, which uses DHCP reserved addresses. I allocate specific IP addresses and lock down the network with firewall rules on the Cisco ASA.
The local wireless access point is a Cisco AP541N-E which uses WPA2 PSK along with MAC Address filtering to further lock down who can access the network via MAC Addresses.
If you wanted to know how the network was configured please get in touch and I can always send you snippets of the configs.
This post explains the investigation steps we took and the tools we used to work out how McAfee Web Control functions within our IT Estate.
Topic on McAfee Forums: https://community.mcafee.com/t5/Endpoint-Security-ENS/Outlook-email-annotations-McAfee-Web-Control/m-p/636770#M5508
Problem / Issue we have with McAfee Web Control
Email annotations do not load on malicious sites that appear in emails in Microsoft Outlook.
How does McAfee Web Control Work?
Web Control uses JavaScript as its core to display the Web Control warning, So Web Control uses executable mfewc.exe to do all the work.
It also calls a child process which can be seen.
Outlook references the DLL files which can be found in the Web Control installation directory (C:\Program Files (x86)\McAfee\Endpoint Security\Web Control) like wchook.dll.
There are two versions of the wchook.dll which are 32bit and 64bit. This has no effect on the Microsoft Office version, just the Windows Operating system architecture.
I used a tool to check the DLL type to confirm this, as you can see the wchook.dll which I believe is used to hook into the Outlook.exe process, does support both 32 & 64bit Windows.
How does Web Control make email annotations to emails like the ones below? Outlook doesn’t have a plugin for this, it’s all controlled with JavaScript.
So there are quite a few Javascript .js files that do the work of displaying the warning in Outlook, the main one is this JS file.
Where does Web Control obtain its ratings, is it from the ePO Server? Ratings do not come from the ePO server. Ratings come from sae.gti.mcafee.com on port 443.
Looking at the logs and using Wireshark I was able to find the websites Web Control was using, and these interesting error messages about HTTP 403 return codes, which basically mean Web Control is unable to get to these sites.
Line 74275: 09/20/2019 11:08:07.056 AM mfewc(6344.7384) <SYSTEM> WebControl.SaSSHMod.Debug: Http request for url [http://sadownload.mcafee.com/products/sa/update.xml] is forbidden (HTTP_STATUS_FORBIDDEN/403)
Line 74274: 09/20/2019 11:08:07.056 AM mfewc(6344.7384) <SYSTEM> WebControl.SaSSHMod.Debug: Http status code returned = 403
I added the following exclusions to the “Semi Restricted Whitelist” and the “CFS URL” list in our SonicWall Firewall. I’m not sure if all these sites are needed such as “akamaitechnologies.com” but when running a packet capture on the client and firewall on a device with a malicious email open I could see this traffic being dropped, that’s why I whitelisted it.
To confirm this was the cause I used “Microsoft Network Monitor” on a working machine, which is a tool that shows you process level network traffic, and you can see that the process “mfewc.exe” McAfee Web Control is communicating on port 443 with McAfee servers.
Testing & Confirming the solution
So as we know Web Control only works on 32bit versions of Outlook, after testing this on a few machines after rebooting them, I was able to get the warning message by using the test site www.screensavers.com.
You can see this being flagged in Outlook and Internet Explorer.
If you look in the log, when McAfee Web Control has found the URL as malicious, it will log it here.
Log tolook for "C:\ProgramData\McAfee\Endpoint Security\Logs\WebControl_Debug.log"
I passed on my findings to McAfee forums to help others. Was really pleased with the response.
