Autopilot Issues when behind an MX

[ChrisIreland]

We have found an issue with trying to use MS Autopilot when behind an MX firewall.
We have created two rules (one for TCP, the other UDP) from the build VLAN to any destination on ports 123,53,80,443,3544.  Every time we try to deploy a laptop using Autopilot it gets stuck.
We have tested these rules on two different non-Meraki firewalls and have not had the issue.
Has anyone else seen this issue?    

[alemabrahao]

Do you have the Threat protection enabled? If yes, try disabling it.

[ChrisIreland]

Hi, Thanks for the reply, there is nothing in the TP logs, but its worth a try!  I'll do some testing today.

[DarrenOC]

Are you seeing anything in the Event logs for the Appliance?

Do you also have an Layer 7 Geo-IP based rules you can rule out?

[ChrisIreland]

Thanks for the reply, nothing in the event logs and no Geo rules on this MX.

[PhilipDAth]

We have used AutoPilot behind MX lots without issue.  We use content filtering, IPS and AMP.  We don't use firewall rules to apply L4 restrictions.

Why don't you try temporarily creating a "permit any any" rule and see if that resolves it?  If it does - you know your firewall rules are the issue.

[ChrisIreland]

Hi, Thanks for the reply.  We have tried a 'permit any any' rule and it works, but due to the environment, we can't leave that in place.  The ports we have open are the MS recommended ones.  We are just a bit stumped about what is being blocked.

[PhilipDAth]

If a "permit any any" works - then you 100% know it is the firewall rules you have added causing the issue.  Perhaps one of the apps you have deployed via Intune needs additional ports.  Perhaps you are doing a hybrid AD join.

I would put back the "permit any any" and do a packet capture while deploying a machine.  Make a note of every port used, add them to the firewall rules, and go back to your "deny any any".

[ChrisIreland · Accepted solution]

Hi, After various tests and packet captures, we have found that we need to add the ephemeral port range and restricted them to the recommended autopilot FQDNs.  And its now working!  A classic of Microsoft documentation not listing everything needed.  Investigating the non-Meraki firewalls, it would appear that they were doing something under their "stateful" badge and allowing these ports even though not directly listed in the rule set.  Thanks for your help. 

[amabt]

The issues we have with AutoPIlot are ussualy

1) Web Proxy (we use Zscaler)

2) Meraki Content Filtering rule.

You can try putting Fiddler one of the AutoPIlot machine and see what URL it stuck on?That will give you a clue as to where to look.

Make sure to allow the URL Microsoft listed for AutoPilot to work. Also check that its not stuck on trying to do WIndows updates,

[ChrisIreland]

Thanks for the reply. I'll do some more testing today and try Fiddler.  The rules allow any destination unfiltered so it should be ok for that.