I keep getting these messages pop up in the web filter:
2017:07:25-06:59:24 gw01-1 httpproxy[11843]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="10.2.28.145" dstip="54.171.178.92" user="" group="" ad_domain="" statuscode="502" cached="0" profile="REF_HttProContaInterLan2 (XXXX LAN filter)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action ALLOW)" size="102952" request="0xda391e00" url="XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX-wdx-8308.broker.sophos.com/.../register" referer="" error="Connection reset by peer"
These are from pc's, laptops etc on our LAN that use Sophos endpoint (standalone) from SEC. The XXXX part is the Sophos Live connect registration information from the UTM.
With SEC, you can apply the UTM web policy to the endpoint clients so when they are out and about, the UTM web policy is applied.
Now, some of these clients are sitting behind the UTM at this moment so I'm wondering id they are being blocked because of this? ie it's just harmless information as those client will be getting updated because they are inside the network?
This thread was automatically locked due to age.
