Antivirus Scanning Interfering with Pandora.

Hi and welcome to thee UTM Community!

https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/45070/master-list-of-web-exceptions/308859#308859

Found by a Google on site:community.sophos.com/products/unified-threat-management/f pandora.

Cheers - Bob

I have read the link you posted, and based on that information, I have implemented the changes below.  I am sorry to report that with the antivirus scanning /ON there is no change in the Pandora behavior on mobile tablets and devices.  

Here is the current programming:

Skipping: Authentication / Block by download size / Antivirus / Sandstorm / Extension blocking / MIME type blocking / URL Filter / Content Removal / SSL scanning / Certificate trust check / Certificate date check / Do not display download/scan progress page
Matching these URLs: pandora.com
^https?://[A-Za-z0-9.-]*pandora.com/
^https?://[A-Za-z0-9.-]*cdn.com/
and Going to these categories of websites: Internet radio/TV Streaming media

If I turn antivirus /OFF Pandora plays normally on tablets and devices. So, we're still missing some key piece.

Show us  a line or two from the Web Filtering log when Pandora is blocked.

Cheers - Bob

BAlfson;

Thank you for your interest. Hope this helps!   The Android smartphone was at "192.168.200.101" and it was skipping every song on Pandora.

2020:05:11-19:23:44 portal httpproxy[26802]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.200.101" dstip="172.217.4.227" user="" group="" ad_domain="" statuscode="204" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" request="0x8526a00" url="connectivitycheck.gstatic.com/generate_204" referer="" error="" authtime="0" dnstime="2516" aptptime="94" cattime="354" avscantime="0" fullreqtime="54282" device="0" auth="0" ua="Dalvik/2.1.0 (Linux; U; Android 6.0.1; Nexus 5 Build/M4B30Z)" exceptions="" category="177" reputation="trusted" categoryname="Content Server" country="United States"
2020:05:11-19:23:45 portal httpproxy[26802]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.200.101" dstip="172.217.4.227" user="" group="" ad_domain="" statuscode="204" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" request="0x8526a00" url="connectivitycheck.gstatic.com/generate_204" referer="" error="" authtime="0" dnstime="1" aptptime="435" cattime="324" avscantime="0" fullreqtime="105994" device="0" auth="0" ua="Dalvik/2.1.0 (Linux; U; Android 6.0.1; Nexus 5 Build/M4B30Z)" exceptions="" category="177" reputation="trusted" categoryname="Content Server"

2020:05:11-19:25:59 portal httpproxy[26802]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="CONNECT" srcip="192.168.200.101" dstip="208.85.42.31" user="" group="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="5655" request="0x8916700" url="mediaserver-cont-sv5-1-v4v6.pandora.com/" referer="" error="" authtime="0" dnstime="1" aptptime="404" cattime="373" avscantime="0" fullreqtime="283765" device="0" auth="0" ua="" exceptions="av,sandbox,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size,patience"

Well, those all look like the traffic passed, so I guess we'll need to look for other lines, we're looking for ones with  statuscode="4xx" or "5xx".

Cheers - Bob

Follow up on Bob's suggestion you can narrow your log activity by check only for "log blocked pages" located edit filter action / additional options / activity logging.  Then open live log and start playing Pandora and narrow your search with filter focus on 192.168.200.101 and hopefully you should see the blocked traffic only.

Good Luck

BAlfson, Bob;

Does this help?

That's what we needed - reason="range" - that breaks ant-virus scanning.  If this is a home-use situation, you might just want to create an anti-virus Exception for the entire Pandora netblock, 208.85.40.0/21.  If a business, I would use DNS Group definitions for the FQDNs being blocked.  Then again, maybe changing the Exception for *cdn.com to *cdn.us would resolve this.

The last line is not for the cdn.us, but for a subdomain of Pandora.com and it already qualified for an AV Exception.  If you're using the Proxy in Standard mode, you will want to skip the Proxy for *.pandora.com in your browser.  If in Transparent, I bet you're stuck with skipping the entire 208.85.40.0/21 subnet.

Please let us know your result.

Cheers - Bob

This is for an adult-only home situation, and after doing some reading, I'm rethinking my question somewhat.

I really don't want to block any content, or websites, or enforce any safe search.  The only reason I turned on the filtering at all was to:

1) Enable Antivirus,

2) Block spyware infection and communication, and

3) Block dangerous extensions.

So what do you gentlemen suggest for web filtering?  Standard or Transparent?  And how should I write the one and only custom exception I appear to need for pandora.com?

That's a great post!  Virtually everyone asks why their solution doesn't work and never offers an insight into what they wanted to have happen.  I didn't even have to ask - refreshing!

I would use a Web Filtering Profile in Standard with the default Profile in Transparent.  In the Transparent Mode Skiplist, skip the entire 208.85.40.0/21 subnet.  In browsers that allow you to skip the Proxy for *.cdn.us and *.pandora.com, configure to use the UTM as an explicit proxy.  Now, Pandora will work on all your devices and those that use Standard mode will skip the the Proxy for the fewest IPs.

Cheers - Bob

That's a great post!  Virtually everyone asks why their solution doesn't work and never offers an insight into what they wanted to have happen.  I didn't even have to ask - refreshing!

I would use a Web Filtering Profile in Standard with the default Profile in Transparent.  In the Transparent Mode Skiplist, skip the entire 208.85.40.0/21 subnet.  In browsers that allow you to skip the Proxy for *.cdn.us and *.pandora.com, configure to use the UTM as an explicit proxy.  Now, Pandora will work on all your devices and those that use Standard mode will skip the the Proxy for the fewest IPs.

Cheers - Bob