This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

URI prefix does not match

Version: 9.109-1

This past week followed the latest article on setting up access to a Remote Desktop Gateway using WAF. Had been using a dnat rule prior to that. Has worked well however tested access using an Andriod tablet with the Microsoft RDP client and have encountered the issue stated in the subject. Below is the log entries showing the URI prefix not matching. Based on the URI value in the log what changes would be needed to the entry url's? I have tried several different entries with no success.

Thanks

2014:03:17-04:18:01 FIREWALL reverseproxy: [Mon Mar 17 04:18:01.576147 2014] [url_hardening:error] [pid 13885:tid 4013575024] [client X.X.X.X:56659] URI prefix does not match, URI: rdgateway.domain.com:443/.../rpcproxy.dll
2014:03:17-04:18:01 FIREWALL reverseproxy: [Mon Mar 17 04:18:01.576156 2014] [url_hardening:error] [pid 13885:tid 4047145840] [client X.X.X.X:56660] URI prefix does not match, URI: rdgateway.domain.com:443/.../rpcproxy.dll

This thread was automatically locked due to age.

0 BAlfson over 10 years ago

What article are you following?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Longman over 10 years ago

https://community.sophos.com/products/unified-threat-management/astaroorg/f/57/t/50169
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago

In the Virtual Server definition, did you select 'Pass host header'?

Cheers - Bob
PS Is there a reason you chose 'Mode: Drop' instead of 'Mode: Reject'?

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Longman over 10 years ago

Yes passing host header. I like to silently drop as opposed to alerting with a rejection.

Thanks for responding..
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago

If you're sure that you've uploaded the right HTTPS certificate and that it's the one in the Virtual Server definition, then I'm lost.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Longman over 10 years ago

Well it works correctly from a windows client which is a majority of what my users have. Not to many android users, yet. I will play around with the url settings time permitting. Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Hallowach2 over 10 years ago

Do the Android devices trust the CA of the cert you used?

Regards
Manfred
Cancel
Vote Up 0 Vote Down

Cancel
0 Longman over 10 years ago

If I bypass the url hardening the android tablet works. It also works using dnat. So the issue is the prefix being sent.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 10 years ago
Well it works correctly from a windows client
If I bypass the url hardening the android tablet works.

Ahah! So, what happens if you add the whole beginning?
https://rdgateway.domain.com:443/rpc

Cheers - Bob
Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Longman over 10 years ago

Tried that - no luck. I believe that something like that is the answer just need time to play with it.
Cancel
Vote Up 0 Vote Down

Cancel