Web filtering issues using Microsoft Edge

Hi MatthewEllis,

Can you DM me the case details for my reference?

Has there been any movement in finding a solution for this issue?  We're experiencing a similar issue with external sites while the user is connected to our domain from a remote location.  Disabling the Sophos Web Filter service resolves and then the redirection from http to https appears to work.  Even when the service is re-enabled the redirect continues to work until the cache is cleared.  

Lori Linehan

I don't have this issue but it sounds a curious one.

The Sophos local proxy on Windows 10 is swi_fc.exe and this process is started by the swi_filter service.  The swi_fc.exe process listens on a port, e.g 12080 but could be different based on ports in use

If a site isn't excluded in policy by IP address then the connection from the browser is sent to 127.0.0.1:12080, swi_fc.exe does its work and then forwards it on to the destination.  Essentially it's a local proxy.

IP exclusions for sites that will bypass the swi_fc proxy entirely and can be configured in SEC under:  
"Anti-Virus and HIPS" policy - "Authorization" - "Websites" - Add IP address.

In Central it is under either the global scanning exclusions - https://cloud.sophos.com/manage/config/settings/scanning-exclusions - Add - "Website (Windows/Mac)" and enter the IP.  You can also add these exclusions in the individual Threat Protection policies if you just want it to apply to certain users or computers.

With IP exclusions, then the connection goes back to connecting to the upstream server directly from the browser rather than via swi_fc.exe.

I see pages which touch on similar issues, such as:
https://developer.microsoft.com/en-us/microsoft-edge/platform/faq/#how-can-i-debug-localhost

Microsoft Edge allows localhost access by default but treats “localhost” as an Internet site, so Intranet features like integrated authentication are disabled.
Some custom host mappings might require additional configuration (more on that here) for which you can run the following command:
CheckNetIsolation LoopbackExempt -a -n="Microsoft.MicrosoftEdge_8wekyb3d8bbwe"

More here: 
https://blogs.msdn.microsoft.com/msgulfcommunity/2015/07/01/how-to-debug-localhost-on-microsoft-edge/  and https://msdn.microsoft.com/en-us/library/windows/apps/hh780593.aspx could be related.

As might: https://blogs.msdn.microsoft.com/fiddler/2011/12/10/revisiting-fiddler-and-win8-immersive-applications/  Note: the link to the AppContianer Loopback Utility can be found here: https://www.telerik.com/fiddler/add-ons the link in the article is broken it seems.

People with such problems on forums, not Sophos related have found running Fiddler (https://www.telerik.com/fiddler) has helped as has just running rawcap (www.netresec.com/ filtering localhost?

I've also read about using the about:flags or Edge to toggle the Allow localhost loopback option.  

Googling for:
edge tabprocconfig
also throws up some interesting results which all seem related.  E.g. https://social.technet.microsoft.com/Forums/en-US/0face535-3c7a-4658-be34-6c376322ca34/microsoft-edge-cant-open-local-domains?forum=win10itpronetworking 

There must be some significance to it being local domains, so maybe sites are being classified as local intranet which is having a bearing.  

http://danlec.com/st4k#questions/32384571 fits in with some of the comments above.

I'd be interested to hear if any of the above links help progress the problems.  The IP exclusion should work if that is a viable option for the problematic sites.

Regards,
Jak

Hi Lori ... I am still working with Sophos engineers to resolve the issue.  No headway has been made, and we are still using workarounds to handle the issue.

Hi Jak,

using rawcap as described does eliminate the issue, but this is not a resolution.

Will look through your other links and see if anything works.  Thanks.

Matthew

Hi Everyone,

The reported issue in this thread is being actively investigated internally and I currently do not have any major update on it. If you are facing the similar issue, please raise a case with the support and DM me the case details so that I can have it tagged to the current Investigation.

Reference ID: WINEP-14780

Is anyone able to test if running the following command from an admin prompt:

CheckNetIsolation LoopbackExempt -a -n="Microsoft.MicrosoftEdge_8wekyb3d8bbwe"

helps, where the "MicrosoftEdge_8wekyb3d8bbwe" comes from the path to edge, e.g.

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe



Regards,
Jak

We're also seeing this issue on our domain machines but only those that have 1709+ installed. Had a 2 hour webex with a developer last week in order to try and move things forward. Whitelisting the IP address of one site seems to mean that users can visit any site after visiting that one site. 

Does it help to add the URLs in IE to the trusted site list?

Also, given the information here:
https://blogs.msdn.microsoft.com/ieinternals/2012/06/05/the-intranet-zone/

about how IE classifies the intranet zone.  If the problematic site is a.b.c.com for example, which resolves to 10.1.1.1, then you might expect that both:
http://a.b.c.com and http://10.1.1.1 would both fail.  However to resolve the site without any '.' (dot) then a hosts file mapping of say:

10.1.1.1 test

Would then http://test work if it is then classified as local intranet.

Regards,
Jak

I've been experiencing the same issues.  Randomly thought it was a TLS Edge issue since it was all fine in Chrome/IE.  However, I did notice that the Edge DevTools showed the connection as Pending.  This suggested to me that the connection was blocked before it even got going and wireshark seemed to agree.  I didn't realise at that point that Web Control installed a local proxy.

Having disabled Web Control, Edge starts working again fine.  One of my developers also noted that when she moved to the guest WiFi instead of our domain network, any website she was having a problem with magically started working.