Jun 01 2022 02:21 AM
Jun 01 2022 02:21 AM
Hi Folks :
We use the Foritgate as Firewall , Provide NAT function let internal network user (About 80Users)to connect to internet.
We have config Fortigate use a single Public Internet IP address , and let Microsoft Teams Service
use this IP to connect to Microsoft Teams Cloud Service
The Fortigate have been disable SSL inspect and Security Check when use this IP
When user about 5-6 create a conference Teams meeting. the meeting is good
But When user about 30-50 User join the same Teams Conference Meeting.
We use RTA to check the Audio is good. But when one user do a Screen Share .
Most the other use's Application sharing details(inboud) will have consistent Packet lost (%18)
We have check the network bandwidth just use 15Mbps. (This line have 80Mbps)
The question is:
Does Microsoft Teams Service will have limit about concurrent connection from the same IP Address?
or any idea? Thanks
Jun 01 2022 04:18 AM
May be this
"Validate the network address translation (NAT) pool size required for user connectivity. When multiple users and devices access Microsoft 365 or Office 365 using Network Address Translation (NAT) or Port Address Translation (PAT), you need to ensure that the devices hidden behind each publicly routable IP address do not exceed the supported number. Ensure that adequate public IP addresses are assigned to the NAT pools to prevent port exhaustion. Port exhaustion will contribute to internal users and devices being unable to connect to the Microsoft 365 or Office 365 service."
This is also a great blog by my friend Lee Ford to run through
Hope that helps and works toward an answer
Jun 01 2022 05:45 AM
Jun 01 2022 05:53 AM
@Donnei_Tsai1128 I would be suspicious of the Fortinet doing any kind of inspection, the volume of Teams media traffic typically quickly overwhelms any capacity on any firewall. Specifically Microsoft recommend against and won't support any inspection of media traffic.
I would simple allow 3478-3481 outbound without any interference on the firewall, the only supported way to make Teams work well.
Jun 01 2022 06:02 AM - edited Jun 01 2022 06:03 AM
Hi Steven. Thanks for reply!
Yes. Our FortiGate Firewall have config Policy to allow Microsoft Teams traffic pass quickly
don't use any SSL Inspection, Security Inspection.....and UDP port 3478-3481 is work
our last to doubt was Ascenlink (WAN Load balance device)
We will try to let Teams traffic not pass through this device and monitor the result.
Jun 01 2022 08:13 AMSolution
Jun 01 2022 06:24 PM - edited Jun 01 2022 06:26 PM
Our largest Team conference meeting have about 25 User at company network and other 25 will at work from home
We reference the document. The Screen Sharing best performance bandwidth will be 4Mbps per client . So we can estimate 25 users will use 100Mbps (the largest bandwidth)
We will monitor this value carefully and try to not use web balance device at the internet access path.
Jun 06 2022 09:25 PM - edited Jun 06 2022 09:29 PM
We have make some network setup like below
1.Our original path to internet : LAN (Internal Network)->FortiGate->WAN Load Balance(Ascenlink)-> 2 ISP Internet Access (for Load Balance and Line Backup)
2.at FortiGate Policy. We create a new Poicy , setting is . Source (Internal Network) -> Destination , Internet Service DB( ISDB) pickup Microsoft_Skype_Teams) , and no SSL Inspection and any UTM Security Profile check. NAT can use 1 IP or 5 IP (IP Pools) configure
3.We use another ISP Line(100/40Mbps) and setup a Policy Route UDP Port 3478-3481 , route to the new created Policy (for Microsoft Teams)
This Policy can make sure Microsoft Teams service access internet don't passthough WAN Load Balance
This moring we have a 47 user conference call, Some WFH and Some at Office ,The meeting host use Desktop Sharing to show his screen (one to many). The finding is:
1.When meeting start . we observe user count over 20 users into the meeting room. We use the RTQ function to monitor my Teams client
We can see The Application sharing detail (inbound) start to grow rapidly to Packet Loss (14%)
Then we change NAT config from 1 IP to 5 IP Pools Config. The Packet Loss will to decrease obvious (about below 0.5%)
2.The line MRTG bandwitdh show 5 Minus average is 20Mbps(Inbound)
3.This configure . Our Desktop Share screen lag will decrease to 1-2 Sec. The original config will be 5-9 Sec.
Very intresting. When the packet loss start to increase obvious. We change NAT use 1 IP change to use 5 IP Pools . It will start to decrease....
sharing the result to people like us.
Jun 11 2022 05:27 PM
Jun 13 2022 06:10 AM
Oct 31 2022 08:28 AM
Did you find any solution about teams conf call?