Online Grammar Checker - Issue

Hi all,

Just a quick update. I referred this issue to Sophos who advised me to bypass the UTM for the site concerned to ensure that it was indeed the UTM that was the problem here.

Not surprisingly, when I reverted to our old Microsoft TMG 2010 to access the site, everything worked OK.

I believe it to be websocket issue and have seen on several posts in this forum that other users have had issues similar to this (I won't expose my ignorance on the topic of websockets at this particular time though). Also I have seen a Feature Request with 700+ votes to get the UTM to handle websockets. As of yet Sophos haven't indicated if they are going to address this particular problem.

In the end I had to disable SSL Scanning for the site in question and all appears to be working fine now. Not my ideal solution, but in the absence of anything from Sophos, will have to do.

Best regards,

John P

Hi John,

Check #1 in the guide here. Any catch with that?

Thanks

HI isoffice ,

Seems that with SSL encryption the issue occurs with the connection on HTTPS (TCP:443.), These are apps that would associate with Google Chrome / Mozilla and in some cases when SSL Scanning is Enabled , issue occurs when the server (remote end ) does not comply with UTM certificate .  At this point,  your only option would need to Bypass the sites from SSL scanning exceptions . 

To work reliably, Grammarly needs a stable Internet connection. Either message can indicate a problem with your local network, your ISP, or your computer settings.

• Your network or system administrator must ensure that your antivirus and (or) firewall software allows access to the following Internet addresses by adding exception rules for the following addresses to your firewall and/or antivirus software:

1. 1. capi.grammarly.com (ports 80 and 443)
   2. api.mixpanel.com (ports 80 and 443)
   3. api.parse.com (ports 80 and 443)
   4. auth.grammarly.com (ports 80 and 443)

Taken from the website https://support.grammarly.com/hc/en-us/articles/206120167-Error-Connecting-to-the-Grammarly-server-message-or-Not-connected-notification-pop-up-What-should-I-do-

Thanks and Regards 

Aditya Patel | Network and Security Engineer.

Hi Guys,

Thank you for the additional information, it has proved quite useful.

Sachingurung, I have checked the logs specified in #1 of Rulz and cannot see anything untoward there.

Aditya, I have created an exception (for SSL Scanning) based on the addresses mentioned in your post. All appears to be working now.

However, the article to which you referred to also states, "If you use a proxy, please verify that it supports WebSocket protocol."

Am I wrong in thinking that the UTM does not support the WebSocket Protocol?

Best regards,

John P

Hi all,

I had raised a call with Sophos Support on this and they have confirmed:

"Unfortunately right now Sophos UTM is unable to handle web socket traffic for web application firewall. So for the mean time you may add exemption for the the destination domain from SSL inspection".

They go on to say that I should add my vote (already done) to the feature request that might resolve this issue (http://ideas.sophos.com/forums/17359-utm-formerly-asg-feature-requests/suggestions/4849021-websocket-support-for-waf).

However, given that the initial feature request was made almost 3 years ago, it looks like my exemption will be in place for the foreseeable future. 

Thank you for your kind assistance.

John P

Hi John 

Could you share your Service Request so I may look into it  ? , Kindly Message me and do not post it for Public viewing. 

Thanks and Regards 

Aditya Patel 

Network and Security Engineer.

Hi Aditya,

I have forwarded those details that you requested.

Best regards,

John Perry

Hi,

I have the similar problem with grammarly add-in users with using Sophos antivirus

How can i get SSL exception for the sophos AV users?

Hi Rasli,

To exempt the Grammarly website from SSL checking, I simply created a new Exception in Web Protection > Filtering Options > Exceptions. I skipped SSL Scanning/Certificate Trust Check and Certificate Date Check for all requests Matching these URLs: Target Domain = ^https?://([A-Za-z0-9.-]*\.)?grammarly\.com/

This seems to work for me.

Best regards,

John P.

That the web application firewall cannot do web socket traffic doesn't mean that the Web Filtering Proxy cannot.

The solution is skipping SSL scanning, as Aditya mentions.

Cheers - Bob