Products Firewalla Gold SE Firewalla Gold Pro Firewalla Gold Plus Firewalla Orange Firewalla Purple SE Firewalla Wi-Fi SD Product Comparison Product Reviews

Intermittent Microsoft Teams connection lost / video freeze behind Firewalla Purple

Follow
Avatar
Tom Kleiberg

Hi Firewalla support/community,

I am experiencing recurring Microsoft Teams connectivity issues behind my Firewalla Purple and would appreciate advice on the best troubleshooting path.

Setup

  • Firewalla Purple as router

  • ISP: fiber 400 Mbit

  • WAN: DHCP/IPoE

  • LAN behind Firewalla

  • Wi-Fi: Aruba Instant APs

  • Affected devices:

    • Managed Windows laptop using Zscaler

    • iPhone using Teams mobile app

  • The issue also occurs on my iPhone, which does not use Zscaler.

Problem

On my managed Windows laptop, Teams video starts but often freezes within a few seconds and Teams appears to hang. It is intermittent; sometimes it works normally.

On my iPhone, Teams shows “connection lost”, then reconnects, and after about one minute loses the connection again.

Already tried

I have already tested:

  • Added Microsoft domains and IP addresses to allow lists

  • Smart Queue on/off

  • DNS Booster on/off

  • DNS resolution against multiple DNS servers

  • Packet capture for DNS requests, but I cannot easily inspect or interpret the capture on the Firewalla box

DNS for teams.microsoft.com appears to resolve successfully and consistently across DNS servers.

I also noticed some private 10.x.x.x traffic on the managed laptop, possibly related to Zscaler, but the iPhone issue suggests the problem may not be limited to Zscaler.

Questions

What would be the recommended next troubleshooting steps?

Specifically, how can I best check whether this is caused by:

  • Firewalla rules/filtering

  • DNS handling

  • IPv6

  • Teams UDP media path / TCP fallback

  • WAN packet loss

  • Smart Queue / bufferbloat

  • Wi-Fi or Aruba roaming

Which logs or packet captures should I collect for Firewalla support?

0

Comments

4 comments

Sort by Date Votes
  • Avatar
    Firewalla

    You should not have freezes based on what you have described. (400mbit is plenty) May I know how many devices do you have on the purple? if you are crossing 50, then may be due to load issue (you need to upgrade to Gold)

    If not, your windows + phone are both connected to what WiFI? have you tried rebooting wifi?

    (DNS issues are usually not related to meetings, unlikely to be related to rules as well)

     

    0
    Comment actions Permalink
  • Avatar
    Tom Kleiberg

    It is a home network, so most devices are IoT and smart speakers, TV, etc. Currently there are 30 online, most of which are IoT that use very little bandwidth. I have rebooted all access points. The access points show a healthy connection with my clients.

    I have tried a wired connection with my laptop, but the problem persists. I have configured another iphone without any pre-configured policies from my employer, and on this device the connection seems more stable, but still sometimes drops.

    Is there any information I can provide that helps in troubleshooting my problems?

    0
    Comment actions Permalink
  • Avatar
    Tom Kleiberg
    • Edited

    Hi Firewalla support,

    I am troubleshooting recurring Microsoft Teams call issues behind my Firewalla Purple with a packet capture on the Firewalla box. I prefer not to share the full packet capture yet, but I would like to share the key observations and ask for guidance on next steps.

    Setup

    • Firewalla Purple as router

    • ISP: fiber

    • WAN: DHCP/IPoE on VLAN 300

    • WAN interface: eth0.300

    • WAN IP: aa.bb.cc.dd <redacted>

    • LAN gateway: 10.0.0.1

    • iPhone Teams client: 10.0.0.183

    • Wi-Fi: Aruba Instant APs

    • The issue also occurs on wired connections with my laptop, so Wi-Fi does not seem to be the primary cause

    • The affected iPhone does not use Zscaler or corporate VPN

    Problem

    During Microsoft Teams calls, the call repeatedly stalls. On the iPhone, Teams shows “connection lost”, then reconnects, and later loses connection again.

    The issue also occurs on a managed Windows laptop. I focused this capture on the iPhone to exclude Zscaler/VPN from the analysis.

    Capture scope

    The capture was taken on Firewalla using tcpdump on interface any, with both LAN/client-side and WAN/NAT-side traffic included.

    Capture filter used:

    ((host 10.0.0.183 and (port 53 or tcp port 443 or udp portrange 3478-3481)) or (host aa.bb.cc.dd and (tcp port 443 or udp portrange 3478-3481)))

    The Teams stalls occurred around these relative capture times:

    58–79s
128–146s
189–207s

    Key observation

    In multiple stall windows, I see the same pattern:

    Microsoft/Teams return traffic reaches the Firewalla WAN IP,
but is not forwarded to the client LAN IP for a long period.

    Example from one stall window:

    Client: 10.0.0.183
Firewalla WAN IP: aa.bb.cc.dd Teams media endpoint: 52.113.39.18

    For this UDP media flow:

    52.113.39.18:3478 → aa.bb.cc.dd:50022

    the inbound WAN packets are visible from the start of the stall window.

    But the corresponding forwarded LAN packets:

    52.113.39.18:3478 → 10.0.0.183:50022

    only appear much later, approximately 16 seconds into the window.

    I see a similar pattern on other Teams UDP media flows, for example:

    52.113.39.18:3479 → aa.bb.cc.dd:50010 52.113.39.18:3479 → 10.0.0.183:50010 52.113.39.18:3481 → aa.bb.cc.dd:50055 52.113.39.18:3481 → 10.0.0.183:50055

    In each case, WAN-side return packets are visible before the LAN-forwarded packets appear.

    TCP 443 observation

    TCP 443 shows a similar pattern. During the same stall window, the iPhone sends TCP SYN packets to Microsoft endpoints, and SYN/ACK responses are visible arriving at the Firewalla WAN IP. However, most of these SYN/ACK responses are not visible as forwarded packets to the iPhone LAN IP.

    This suggests the issue is not limited to Teams UDP media traffic.

    DNS observation

    DNS does not appear to be the primary cause. I do see DNS queries from the iPhone to Firewalla, but I do not see relevant NXDOMAIN, SERVFAIL, or REFUSED responses for Teams/Microsoft domains that would explain the call stall.

    The strongest pattern is not DNS failure, but return traffic reaching WAN and not appearing on LAN toward the client.

    Current interpretation

    This does not look like simple upstream packet loss from the ISP, because the Microsoft/Teams return packets are visible arriving at the Firewalla WAN IP.

    It also does not look like a Zscaler issue, because this specific capture is from an iPhone without Zscaler/VPN.

    It also does not look primarily Wi-Fi-related, because the issue also occurs on wired connections with my laptop.

    The issue looks more like one of these:

    • Firewalla NAT/state/conntrack forwarding issue

    • Firewalla temporarily not forwarding return traffic to the LAN client

    • Firewalla packet processing/filtering/state inspection issue

    • Possible interaction with Teams UDP media and TCP 443 sessions

    • Possible issue with Firewalla handling return traffic across WAN/LAN during real-time media calls

    Questions

    Could you advise how to continue troubleshooting this?

    Specifically:

    1. How can I verify whether Firewalla is dropping or delaying WAN return packets before forwarding them to the LAN client?

    2. Which Firewalla logs or commands should I check for NAT, conntrack, packet forwarding, or state table issues?

    3. Should I capture on specific interfaces instead of any, for example eth0.300 for WAN and the LAN bridge/interface separately?

    4. Are there known issues with Firewalla Purple and high-rate UDP media flows such as Microsoft Teams?

    5. Are there specific Firewalla features I should disable for a controlled test, such as Active Protect, Ad Block, DNS Booster, IPv6, Smart Queue, or other packet/state inspection features?

    6. Would Emergency Access bypass all relevant processing for this kind of issue, or could NAT/conntrack/forwarding problems still occur even with Emergency Access enabled?

    7. Is there a recommended way to inspect conntrack/NAT state for a specific client and Microsoft Teams endpoint during a stall?

    Any recommended step-by-step troubleshooting approach would be appreciated.

    0
    Comment actions Permalink
  • Avatar
    Firewalla CM

    Hi Tom, I've opened a case for you. Our support engineers can take a better look and see what might be going on. Please look out for an email from us. 

    0
    Comment actions Permalink

Please sign in to leave a comment.

Didn't find what you were looking for?

New post