Issue with rules

Hi,

do you have rules below your block rules that allow the traffic? When you review log viewer for the blocked IP address what rule is shown as allowing the traffic to pass?
ian

Hi,

do you have rules below your block rules that allow the traffic? When you review log viewer for the blocked IP address what rule is shown as allowing the traffic to pass?
ian

Yes there are allow rules lower. Log viewer says its denying the traffic.

Here is the rule

Hello Super CM,

Thank you for the screenshot!

Did you test with the Test Policy checker that the user/ip are actually using the Firewall rule associated to this Web Policy?

If you checked and it does, maybe when the user actually sends this traffic is not being sent with the username which will cause not to take this Firewall rule. 

Are you using authentication on the Firewall? 

You could check if you enable debug in the following log from the Advanced Shell

# service awarrenhttp:debug -ds nosync

And then check the 

# awarrenhttp_access.log

Have the user try to access youtube and grep for his/her IP address

tail -f awarrenhttp_access.log | grep "x.x.x.x" (x.x.x.x is the IP of the user)

This would tell you the Firewall rule that is being actually used.

Regards,

I am not using authentication. And the second command did not work (the first did with a 200 ok)

SFVH_HV01_SFOS 18.0.1 MR-1-Build396# awarrenhttp_access.log                     
/bin/sh: awarrenhttp_access.log: not found                            

Any help with that command that is failing? 

You should start with the HTTP vs HTTPs test. Are the tests here blocked or not? 
https://sophostest.com/
and try http://sophostest.com

Hi Super CM,

"awarrenhttp_access.log" is a file located in /log/, not a command.

emmosophos is asking you to execute this command:

=> tail -f /log/awarrenhttp_access.log | grep "x.x.x.x" (x.x.x.x is the IP of the user)

An example of the full command is: tail -f /log/awarrenhttp_access.log | grep "10.0.0.10"

Thanks!

It's an https only site and the test says it should be blocked. 

Thank you, I will try that as I was missing the /log location. 

The traffic in question, does not show up when i run that commend. There is other traffic but not the traffic that I am trying to block.

Any other thoughts here?