Thread Info
  • State Suggested Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 8 replies
  • Answers 2 answers
  • Subscribers 5 subscribers
  • Views 13627 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HTTPS "URL filtering only" option enabled shows ssl warnings on all https websites or the page cannot be displayed after a while.

Stephan Stoke

Enviroment: HOME
sophos UTM 9.506-2 on Hyper-V.
UTM is behind NAT
Sophos UTM upgraded from 9.505-4 to 9.506-2

9.505-4: no problem
9.506-2: webfilter problem (see below)

Problem: HTTPS "URL filtering only" option enabled shows ssl warnings on all https websites or the page cannot be displayed after a while.
It looks like when using two networks in one and the same default webfilter profile the problem occurs.



Problem is resolved when: "Do not proxy HTTPS traffic in transparent mode" is enabled
Problem is temporary resolved when: UTM is rebooted (but after a while the problem is back again and HTTPS sites shows unsafe SSL warning)

Problem is solved for good when two seperated Web Filter Profiles are created for each network:



Can somebody tell me why this is happening? Thanks!

Regards, Stephan



This thread was automatically locked due to age.
  • 0

    Hi,

    a question, why do you have your external interface in the allowed networks, you should only have your internal networks in allowed networks?

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hi Ian,

    This is because I still have some clients on that network (192).
    Also because I have the UTM behind an existing NAT (ISP router)
    So my UTM "external" interface is actually an internal ip because the UTM is not directly attached to the internet/ISP.
    The External_192.168.1.0 Interface is using the GW address internal ip adres of my ISP router to communicate to external/WAN.

    So now I have two gateways on the same UTM. One for 192 network and the other one for 172 network.

    Hope this answered your question.

    Regards.

  • 0 in reply to Stephan Stoke

    Hi Stephan,

    thank you it does answer the question, but is not logical to have the web proxy loop back on itself. I doubt whether any 192 traffic will actually go through the UTM, but that will depend on your gateway on the other devices?

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • +1 in reply to rfcat_vk

    Hi Ian,

    That's the funny thing. I was testing if it was capable to loopback the traffic and it does :)
    When I change the gateway of a client on the 192 network to the 192 gateway of the UTM the traffic will go through the UTM.
    Also with WAF the traffic from the WAN (ISP router) to the UTM then loopsback to the Service in the 192 network.

    I agree that this solution is not the most logical and absolutely not recommended for business but for a home network it's working just fine.
    But mabey not for web filter anymore?

    Regards.

  • 0 in reply to Stephan Stoke

    I have to agree with Ian, Stephan.  In fact, if you can't put the UTM at the edge where it can get a public IP, I would bridge the two interfaces and change the topology so that everything is behind it.  In that way, you can use Web Filtering in Transparent mode for all of your web traffic.  Since the UTMs interfaces are bridged, I would use 'Full Transparent' mode.  With that choice, the HTTP Proxy doesn't masquerade the web requests.

    Cheers - Bob
    PS Moving this thread to the Web Filtering forum.

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi Guys,

    Thanks for the feedback!
    I have put the other clients on my 192 to my 172 network.

    I also have tried to bridge without any luck (must been doing something wrong here). Do you know if there is some good documentation about bridging the UTM?

    Anyway, so at this moment the UTM still behind my existing NAT (ISP router) and all other clients from the 192 are now on the 172 network. Works like a charm and no loopback!

    Situation now: ISP router --> <--192-- UTM --172--> Clients (web filter activated only on 172_internal).

    Thanks and regards!

  • 0

    About the S.S.L. warnings:

    To display a block or warn message, UTM has to impersonate the target server -- no other option.   This means that you need to distribute the proxy ca certificate even if you had not intended to do https decrypt-and-scan.   But once it is distributed, you might as well do https inspection as well.

    The warnings indicate that it has not been pushed out to your clients.

    The need for two profiles  is harder for me to explain.   But it is best to have a separate profile for each security zone.     If you need to restrict traffic from crossing from zone 1 to zone 2, this goes in the filter action website block list for zone 1.

  • 0

    About the S.S.L. warnings:

    To display a block or warn message, UTM has to impersonate the target server -- no other option.   This means that you need to distribute the proxy ca certificate even if you had not intended to do https decrypt-and-scan.   But once it is distributed, you might as well do https inspection as well.

    The warnings indicate that it has not been pushed out to your clients.

    The need for two profiles  is harder for me to explain.   But it is best to have a separate profile for each security zone.     If you need to restrict traffic from crossing from zone 1 to zone 2, this goes in the filter action website block list for zone 1.

Unfiltered HTML