Microsoft Office365 users behind Cisco Meraki firewalls found themselves unable to reach their services, after the security vendor inadvertently blocked legitimate traffic.
The firewalls were identifying legitimate traffic as an attempted denial-of-service attack against Windows IIS, as reported in this Reddit post.
“We use Meraki firewalls and starting this morning Meraki was blocking valid Microsoft IPs in the Security Center. The SNORT rule details were ‘Microsoft Windows IIS denial-of-service attempt” and the destination IPs were Microsoft’,” the post states.
SNORT is an open source signature-based intrusion prevention system.
Perhaps because of the timing of the issue, the first reports of the outage came from the Europe, Middle East and Asia (EMEA) region, as Microsoft’s 365 Status Twitter account noted.
“We’re investigating an issue where some users in the EMEA region are unable to connect to some Microsoft 365 services,” the tweet stated.
Microsoft later stated: “We’re working with our firewall partners to investigate SNORT rule 1-60381.
“We’ve received confirmation from some affected users that disabling the rule provides immediate relief.”
Meraki agreed the issue was caused by a new SNORT rule: “We would like to make you aware of a vulnerability reported by Microsoft CVE-2022-35748 , triggering SNORT rule 1-60381.
“SNORT is correctly protecting your networks from a known vulnerability and therefore operating as intended.”
Affected services included Exchange Online, Microsoft Teams, Outlook desktop clients, and OneDrive for Business.
After three hours, Meraki stated: “A fix has been pushed out and any pending issues should auto-resolve by 3:00 PM PST [US Pacific Standard Time].”
