Make sure your MX appliances are on the same version of firmware.  Also open a ticket with support, you may have some sort of MTU mismatch.  They will have you run some iPerf and do some other testing. ... View more

haha nice, you are correct I just did a bit of searching and pulled this list from a r/sysadmin post on blocking TicTok.  It's also over a year old so your mileage may vary.  I had this same problem blocking WhatsApp.  The IP range list was huge because of their integration with Facebook.  This is why I suggested trying to use Umbrella first.  Cheers!     v16a.tiktokcdn.com ib.tiktokv.com v16m.tiktokcdn.com api.tiktokv.com log.tiktokv.com api2-16-h2.musical.ly mon.musical.ly p16-tiktokcdn-com.akamaized.net api-h2.tiktokv.com v19.tiktokcdn.com api2.musical.ly log2.musical.ly api2-21-h2.musical.ly abtest-sg-tiktok.byteoversea.com abtest-va-tiktok.byteoversea.com gts.byteoversea.net isnssdk.com lf1-ttcdn-tos.pstatp.com muscdn.com musemuse.cn musical.ly p1-tt-ipv6.byteimg.com p1-tt.byteimg.com p16-ad-sg.ibyteimg.com p16-tiktok-sg.ibyteimg.com p16-tiktok-sign-va-h2.ibyteimg.com p16-tiktok-va-h2.ibyteimg.com p16-tiktok-va.ibyteimg.com p16-va-tiktok.ibyteimg.com p26-tt.byteimg.com p3-tt-ipv6.byteimg.com p9-tt.byteimg.com pull-f3-hs.pstatp.com pull-f5-hs.flive.pstatp.com pull-f5-hs.pstatp.com pull-f5-mus.pstatp.com pull-flv-f1-hs.pstatp.com pull-flv-f6-hs.pstatp.com pull-flv-l1-hs.pstatp.com pull-flv-l1-mus.pstatp.com pull-flv-l6-hs.pstatp.com pull-hls-l1-mus.pstatp.com pull-l3-hs.pstatp.com pull-rtmp-f1-hs.pstatp.com pull-rtmp-f6-hs.pstatp.com pull-rtmp-l1-hs.pstatp.com pull-rtmp-l1-mus.pstatp.com pull-rtmp-l6-hs.pstatp.com quic-tiktok-core-proxy-i18n-gcpva.byteoversea.net quic-tiktok-proxy-i18n-gcpva.byteoversea.net sf1-ttcdn-tos.pstatp.com sf16-ttcdn-tos.ipstatp.com sf6-ttcdn-tos.pstatp.com sgsnssdk.com tiktok-lb-alisg.byteoversea.net tiktok-lb-maliva.byteoversea.net tiktok-platform-lb-alisg.byteoversea.net tiktok.com tiktokcdn-in.com tiktokcdn-us.com tiktokcdn-us.com.atomile.com tiktokcdn.com tiktokcdn.com.atomile.com tiktokcdn.com.c.bytetcdn.com tiktokcdn.com.c.worldfcdn.com tiktokcdn.com.rocket-cdn.com tiktokd.org tiktokv.com tiktokv.com.c.worldfcdn.com tiktokv.com.c.worldfcdn2.com tlivecdn.com ttlivecdn.com ttlivecdn.com.c.worldfcdn.com ttoversea.net ttoverseaus.net   71.18.0.193 ByteDance Inc. AS396986 71.18.0.0/24 United States 71.18.0.194 ByteDance Inc. AS396986 71.18.0.0/24 United States 71.18.0.196 ByteDance Inc. AS396986 71.18.0.0/24 United States 71.18.1.224 ByteDance Inc. AS396986 71.18.1.0/24 United States 71.18.1.248 ByteDance Inc. AS396986 71.18.1.0/24 United States 5.8.92.62 161.117.70.145 161.117.71.36 161.117.71.33 161.117.70.136 161.117.71.74 216.58.207.0/24 47.89.136.0/24 47.252.50.0/24 205.251.194.210 205.251.193.184 205.251.198.38 205.251.197.195 185.127.16.0/24 182.176.156.0/24 ... View more

If you are using Umbrella, there is an application category for TikTok.  You can block it from there.  Otherwise, you could try range blocking the IP/hostname like PhillipDAth says above. ... View more

I forgot to mention, if you are using your current NPS for authentications that you don't want MFA for, you will have to build another exclusive NPS server just for MFA.  It's all or nothing unfortunately.  Let me know if you have questions. ... View more

You can use Microsoft's NPS to Entra MFA plugin on your NPS server.  We are currently using this at one of our sites because we have many contractors we need to apply firewall rules to (using filter ID).  It has been working well.   you can find info here:  Use Microsoft Entra multifactor authentication with NPS - Microsoft Entra ID | Microsoft Learn  ... View more

Hello, yes, it is totally possible.  First, you will need to contact support and have them enable SAML auth for anyconnect.  We use Azure MFA, and it is very straight forward using enterprise app for anyconnect.  Let me know if you have questions.   cheers! ... View more

Hi, I have never tried it on an MX, but you could try using a source-based route at the bottom of addressing and vlans page.  just be very specific and careful, as you can take down your whole network.   ... View more

UDP 500 is used for ISAKMP phase 1 for tunnel encryption.  It is normal.   Cheers! ... View more

I just updated my thread on this.  Our org was fighting with the same issue, as we are moving to MX from ASA, and we have many contractors that need specific access over VPN.  The only way I was able to solve the issue was to use the NPS Azure AD mfa plugin.  Instructions found here: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension   then I used Filter-ID in NPS connection policy to push Meraki group policy for specific firewall rules.  So far it has been working great.  Let me know if you need any help or mor info.  Cheers!   ... View more

Update here:   Thanks for the suggestions.  After much frustration and troubleshooting I have solved the problem by using radius and the azure MFA connector for NPS found here https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension.  I am using filter-ID in NPS to push group policy firewall rules for our contractors and other groups that need VPN access, and it seems to be working great so far. ... View more

I posted this in another thread, but I am going to add my two cents here as well.   For anyone dealing with this issue, Meraki and Umbrella were unable to provide a complete solution, due to whatsapp heavy integration with Facebook.  Umbrella and Meraki can block the web and desktop app, but the mobile app continued to work.  I had to use a layer 3 firewall rule to block the Facebook IP ranges associated with Whatsapp.  You can find them here: https://developers.facebook.com/docs/whatsapp/guides/network-requirements/ under the IP addresses section.  It was a complete pain to create 230 objects and 2 object groups (remember object groups only be 150 objects max) but I have successfully blocked whatsapp completely.  I know that the ip addresses may change in the future, but that is something I will just have to deal with when it comes along. ... View more

For anyone dealing with this issue, Meraki and Umbrella were unable to provide a complete solution, due to the heavy integration with Facebook.  Umbrella and Meraki can block the web version, but the mobile app continued to work.  I had to use a layer 3 firewall rule to block the Facebook IP ranges associated with Whatsapp.  You can find them here: https://developers.facebook.com/docs/whatsapp/guides/network-requirements/ under the IP addresses section.  It was a complete pain to create 230 objects and 2 object groups (remember object groups only be 150 objects max) but I have successfully blocked whatsapp completely.  I know that the ip addresses may change in the future, but that is something I will just have to deal with when it comes along.   ... View more