Autopilot Issues when behind an MX

Solved
ChrisIreland
Here to help

Autopilot Issues when behind an MX

We have found an issue with trying to use MS Autopilot when behind an MX firewall.
We have created two rules (one for TCP, the other UDP) from the build VLAN to any destination on ports 123,53,80,443,3544.  Every time we try to deploy a laptop using Autopilot it gets stuck.
We have tested these rules on two different non-Meraki firewalls and have not had the issue.
Has anyone else seen this issue?    

1 Accepted Solution

Hi, After various tests and packet captures, we have found that we need to add the ephemeral port range and restricted them to the recommended autopilot FQDNs.  And its now working!  A classic of Microsoft documentation not listing everything needed.  Investigating the non-Meraki firewalls, it would appear that they were doing something under their "stateful" badge and allowing these ports even though not directly listed in the rule set.  Thanks for your help. 

View solution in original post

10 Replies 10
alemabrahao
Kind of a big deal
Kind of a big deal

Do you have the Threat protection enabled? If yes, try disabling it.

I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.

Hi, Thanks for the reply, there is nothing in the TP logs, but its worth a try!  I'll do some testing today.

DarrenOC
Kind of a big deal
Kind of a big deal

Are you seeing anything in the Event logs for the Appliance?

 

Do you also have an Layer 7 Geo-IP based rules you can rule out?

Darren OConnor | doconnor@resalire.co.uk
https://www.linkedin.com/in/darrenoconnor/

I'm not an employee of Cisco/Meraki. My posts are based on Meraki best practice and what has worked for me in the field.

Thanks for the reply, nothing in the event logs and no Geo rules on this MX.

PhilipDAth
Kind of a big deal
Kind of a big deal

We have used AutoPilot behind MX lots without issue.  We use content filtering, IPS and AMP.  We don't use firewall rules to apply L4 restrictions.

 

Why don't you try temporarily creating a "permit any any" rule and see if that resolves it?  If it does - you know your firewall rules are the issue.

Hi, Thanks for the reply.  We have tried a 'permit any any' rule and it works, but due to the environment, we can't leave that in place.  The ports we have open are the MS recommended ones.  We are just a bit stumped about what is being blocked.

If a "permit any any" works - then you 100% know it is the firewall rules you have added causing the issue.  Perhaps one of the apps you have deployed via Intune needs additional ports.  Perhaps you are doing a hybrid AD join.

 

I would put back the "permit any any" and do a packet capture while deploying a machine.  Make a note of every port used, add them to the firewall rules, and go back to your "deny any any".

Hi, After various tests and packet captures, we have found that we need to add the ephemeral port range and restricted them to the recommended autopilot FQDNs.  And its now working!  A classic of Microsoft documentation not listing everything needed.  Investigating the non-Meraki firewalls, it would appear that they were doing something under their "stateful" badge and allowing these ports even though not directly listed in the rule set.  Thanks for your help. 

amabt
Building a reputation

The issues we have with AutoPIlot are ussualy

 

1) Web Proxy (we use Zscaler)

2) Meraki Content Filtering rule.

 

You can try putting Fiddler one of the AutoPIlot machine and see what URL it stuck on?That will give you a clue as to where to look.

 

Make sure to allow the URL Microsoft listed for AutoPilot to work. Also check that its not stuck on trying to do WIndows updates,

Thanks for the reply. I'll do some more testing today and try Fiddler.  The rules allow any destination unfiltered so it should be ok for that.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels