Watchguard firewall causing migrationwiz migration to office 365 from SBS 2011 standard to fail?z

Migration wiz uses endpoint i.e. autodiscover from your local SBS server for migration. I don't think it can be a firewall issue since port 443 and 25 should already be opened.

You can test autodiscover using testexchangeconnectivity.com to see if autodiscover test passes on onpremise.

Can you paste the error of the failed mailboxes in here for review.

I'm running them again.  But here's some.  1 user got 1000 errors of this, another got a lower number.  but they passed the password veriification.

Active Directory is unavailable. Try again later

The request failed. Unable to connect to the remote server ---> Unable to connect to the remote server ---> No connection could be made because the target machine actively refused it 75.127.196.xxx:443

The request failed. Unable to connect to the remote server ---> Unable to connect to the remote server ---> A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 75.127.196.xxx:443

This is one I hadn't seen before:

Inconsistent get item response (0 items returned but more are available)

it's an older 2011 standard SBS so is there maintenance I should be doing first?

The autodiscver test:

      The Microsoft Connectivity Analyzer is attempting to test Autodiscover for x@y.com
       Autodiscover was tested successfully.

I see this:

The request failed. Unable to connect to the remote server ---> Unable to connect to the remote server ---> No connection could be made because the target machine actively refused it 75.127.196.xxx:443

So basically target machine i.e. SBS server has refused request on port 443.

Can you check what IP: 75.127.196.xxx is. Is this the IP of your firewall. If yes then make sure to open port 443 for IP: 75.127.196.xxx

Kindly follow Migration Wiz article for firewall requirement: "How do I set up router ports for OWA traffic when performing an On-Premises Exchange to On-Premises Exchange migration?"

https://help.bittitan.com/hc/en-us/articles/115008107167

Based on your details and issues to date, I tend not to think that it is the firewall.   HOWEVER, if your port 80 and 443 rules are proxies, I could see where this could intermittently get in the way depending on the contents of the mailbox.  Especially if you have Deep Packet Inspection turned on.  

This could be a complex issue to resolve and even more so without me knowing what your config looks like.  But a relatively simple (but less secure) way to deal with this would be to create an unfiltered packet filter outbound from the machine running the migration wizard.   Because 365 has so many sub URLs, I would just add HTTP and HTTPS rules (not HTTP-Proxy and HTTPS-Proxy) from the IP of the migrationwiz server to Any-External.   Because it is a packet filter and pretty specific in nature, it should come in higher than your default proxy rules and take precedence (assuming yout auto-order is on as it should be).   I would also turn on logging for that rule so that you can prove that it is being used.     Once you can launch the wizard and see that traffic traversing the new packet filter rules, run your migration test again.  If it succeeds, you are good to go.   If it does not succeed, you can be pretty sure that it is not the firewall causing the issue.  

Good luck.
~Jon

thanks saif.  I lowered the concurrent migrations to 1 and it's working.

Glad I could help...