Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 33 replies
  • Subscribers 50 subscribers
  • Views 10179 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Traffic inspection bug relay_invalid_traffic

l0rdraiden

Is this bug going to be fixed, or it has become a feature with a workaround?

Workaround

https://support.sophos.com/support/s/article/KB-000035989?language=en_US&c__displayLanguage=en_US#How-to-Enable-relay_invalid_traffic

BUG reason="HTTP parsing error encountered."

https://community.sophos.com/xg-firewall/sfos-eap/sfos-v18-early-access-program/f/feedback-and-issues/117316/bug---ssl-tls-inspection-seems-to-break-honeywell-smart-devices

BUG reason="HTTP pipelined request encountered."

https://community.sophos.com/xg-firewall/f/discussions/119219/bug-web-filter-blocking-random-categories



This thread was automatically locked due to age.
Parents
  • 0

    Thanks to everyone who has reported sites or applications that trigger the HTTP pipelining issue.

    Could you also confirm which firmware version you are using when you make these reports. There were some issues addressed in v18.0 MR4 where packet boundary issues sometimes caused the Firewall to report pipelining where it wasn't actually being used. If you're not using MR4, it would be great if you could upgrade and see if the problem persists.

  • 0 in reply to RichBaldry

    I am using v18.0 MR4.
    Unfortunately, there are still issues.

  • 0 in reply to core_memory

    Trying to reproduce the issue with MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT, I see similar requests from Windows machines on my network but they are never getting blocked or logged as pipelined.

    The requests to go.microsoft.com/fwlink/... always gets a status_code="302" response - a redirection.

    They are always followed in the log by a request to dmd.metaservices.microsoft.com

    There is then another request to go.microsoft.com/fwlink/... but this always seems to come over a new TCP connection (it has a different source port), so it cannot be Pipelined.

    Perhaps you could take a look in the detailed log viewer and filter it on "go.microsoft.com". It would be interesting to see (a) how often these requests are blocked as Pipelined, and (b) if there are requests logged immediately after or before the 'blocked' ones that might give us some hints as to why some are OK and some not.

  • 0 in reply to RichBaldry

    Thank you for your support.

    (a) "HTTP pipelined request encountered." was 1/64.
    (b) There was no access from the same source port.

    And Denied with reason="" was 18/64.
    When is this? Is this related?

Reply Children
No Data
Unfiltered HTML