Web filtering issues using Microsoft Edge

Hi,

There is no EDGE browser for the Microsft Windows 7 platform. 

Create a new web category and add your domain to the newly created category. 

Regards,

Deepak Kumar

I am afraid I do not follow your solution.

I am using an on-premise SEC version 5.5.0 to manage the endpoints.

Under web control, I have options for category blocking, or to assign website exceptions (allow/block).  Is that what you are referencing?

Hi,

Yes, I am talking about website exceptions as you can do it. There are multiple possibilities to do the same as a tag on a website, add customized category etc. 

Regards,

Deepak Kumar

This doesn't seem like best practice, as I do not want to whitelist our entire web domain space.  Given the size and distributed nature of our organization, it is possible that some sites within our domain might become compromised.

Is this the only option?  Also, why does this issue only affect Edge and not other browsers?

Hello,

We are having the exact same issue, but we are using Sophos Central. It works on some machines but not others. I can't seem to find a commonality or pattern as to why this is happening. I have to do the same thing with the services to get it to work. Our end users are confused, as Windows 10 has Edge as the most branded browser to use.

I will let you know if I find anything.

Thank you

Hello,

We are having the exact same issue, but we are using Sophos Central. It works on some machines but not others. I can't seem to find a commonality or pattern as to why this is happening. I have to do the same thing with the services to get it to work. Our end users are confused, as Windows 10 has Edge as the most branded browser to use.

I will let you know if I find anything.

Thank you

I have a support case open about this now ... will update here if/when they come up with a resolution.

Thanks, Matthew! I stumbled into this issue as well. I've been digging into TLS cipher suites for a couple hours now and comparing dev/production settings. Then, I tried stopping the Sophos web filtering service and the web page loaded. I almost fell out of my chair. Looking forward to your resolution!

Hi John Whitford,

Can you please confirm if there is any other 3rd party Anti-virus client running alongside with Sophos Client?

Hello, I confirmed there are no other 3rd party anti-virus clients running alongside with the Sophos client. I also checked 2 personal Windows 10 system with the Edge browser and the page loaded without issue. One of these systems only had Windows Defender and the other had Cylance Home Edition installed.

Case is still open but I will update here when we have a resolution.

Hi MatthewEllis,

Can you DM me the case details for my reference?

Has there been any movement in finding a solution for this issue?  We're experiencing a similar issue with external sites while the user is connected to our domain from a remote location.  Disabling the Sophos Web Filter service resolves and then the redirection from http to https appears to work.  Even when the service is re-enabled the redirect continues to work until the cache is cleared.  

Lori Linehan

I don't have this issue but it sounds a curious one.

The Sophos local proxy on Windows 10 is swi_fc.exe and this process is started by the swi_filter service.  The swi_fc.exe process listens on a port, e.g 12080 but could be different based on ports in use

If a site isn't excluded in policy by IP address then the connection from the browser is sent to 127.0.0.1:12080, swi_fc.exe does its work and then forwards it on to the destination.  Essentially it's a local proxy.

IP exclusions for sites that will bypass the swi_fc proxy entirely and can be configured in SEC under:  
"Anti-Virus and HIPS" policy - "Authorization" - "Websites" - Add IP address.

In Central it is under either the global scanning exclusions - https://cloud.sophos.com/manage/config/settings/scanning-exclusions - Add - "Website (Windows/Mac)" and enter the IP.  You can also add these exclusions in the individual Threat Protection policies if you just want it to apply to certain users or computers.

With IP exclusions, then the connection goes back to connecting to the upstream server directly from the browser rather than via swi_fc.exe.

I see pages which touch on similar issues, such as:
https://developer.microsoft.com/en-us/microsoft-edge/platform/faq/#how-can-i-debug-localhost

Microsoft Edge allows localhost access by default but treats “localhost” as an Internet site, so Intranet features like integrated authentication are disabled.
Some custom host mappings might require additional configuration (more on that here) for which you can run the following command:
CheckNetIsolation LoopbackExempt -a -n="Microsoft.MicrosoftEdge_8wekyb3d8bbwe"

More here: 
https://blogs.msdn.microsoft.com/msgulfcommunity/2015/07/01/how-to-debug-localhost-on-microsoft-edge/  and https://msdn.microsoft.com/en-us/library/windows/apps/hh780593.aspx could be related.

As might: https://blogs.msdn.microsoft.com/fiddler/2011/12/10/revisiting-fiddler-and-win8-immersive-applications/  Note: the link to the AppContianer Loopback Utility can be found here: https://www.telerik.com/fiddler/add-ons the link in the article is broken it seems.

People with such problems on forums, not Sophos related have found running Fiddler (https://www.telerik.com/fiddler) has helped as has just running rawcap (www.netresec.com/ filtering localhost?

I've also read about using the about:flags or Edge to toggle the Allow localhost loopback option.  

Googling for:
edge tabprocconfig
also throws up some interesting results which all seem related.  E.g. https://social.technet.microsoft.com/Forums/en-US/0face535-3c7a-4658-be34-6c376322ca34/microsoft-edge-cant-open-local-domains?forum=win10itpronetworking 

There must be some significance to it being local domains, so maybe sites are being classified as local intranet which is having a bearing.  

http://danlec.com/st4k#questions/32384571 fits in with some of the comments above.

I'd be interested to hear if any of the above links help progress the problems.  The IP exclusion should work if that is a viable option for the problematic sites.

Regards,
Jak

Hi Lori ... I am still working with Sophos engineers to resolve the issue.  No headway has been made, and we are still using workarounds to handle the issue.

Hi Jak,

using rawcap as described does eliminate the issue, but this is not a resolution.

Will look through your other links and see if anything works.  Thanks.

Matthew