This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Could not open some of the websites without web proxy

Hi.

I'm recently failed to open some of the websites when behind the XG Firewall, but when I set the web proxy on the computer to the firewall, it worked. The links are valid and normal I believe, like,

rupress.org/.../Epigenetic-and-transcriptional-control-of

I couldn't even install Sophos Intercept X with SophosSetup.exe last night. I checked the log and it couldn't access the Sophos website for downloading the installation files.

I couldn't also connect to WebEx few hours ago with web proxy.

What I tried,

1. setting an empty firewall rules without adding any polices and allowing all connections

2. adding the domains to exception list

3. stopping the SSL scan

But nothing worked. It affects only the LAN but not the connections through VPN.

P.S. I didn't realize XG and UTM are two different types of firewalls, I made a mistake a posted on UTM, community.sophos.com/.../474280

This thread was automatically locked due to age.

Top Replies

Administrator User484 over 3 years ago in reply to rfcat_vk +1

I guess you mean this page ? community.sophos.com/.../sophos-firewall-v185-mr1-eap

0 rfcat_vk over 3 years ago

Hi,

the website works for me. If you do a dns check from the XG GUI, does it get a result?
ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Administrator User484 over 3 years ago in reply to rfcat_vk

DNS lookup got a result.

I tried to switch on "Use web proxy instead of DPI engine" in the firewall rule and somehow it works now. I tried to disable Web Policy on a testing firewall rules but didn't get luck.

Does it mean web traffics will still be scanned without a Web Policy ? And why that option makes a difference ?
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 3 years ago in reply to Administrator User484

No, the scanning does not take place unless you tick some of the boxes.

Which version of XG are you running, if v18.0.5 then I suggest you upgrade to v18.5.1 seems to have fixed some of your issues.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Administrator User484 over 3 years ago in reply to rfcat_vk

I'm on "SFOS 18.0.5 MR-5-Build586" but I didn't see any choices in "Latest available firmware".
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 3 years ago in reply to Administrator User484

You have to download if from the EAP page.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Administrator User484 over 3 years ago in reply to rfcat_vk

I guess you mean this page ?
community.sophos.com/.../sophos-firewall-v185-mr1-eap
Cancel
Vote Up +1 Vote Down

Cancel
0 Administrator User484 over 3 years ago in reply to Administrator User484

I've just upgraded to 18.5 but I still found that my testing firewall rules with checking anything inside the "Web Filtering" section didn't work. But if I set the Web Policy to "Allow All" and check the "Use web proxy instead of DPI engine", I could access the websites just like before. I wonder what is the difference between "None" and "Allow All" ?
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 3 years ago in reply to Administrator User484

None, will use the default SSL/TLS inspection whereas allow all allows you to select the proxy. The DPI engine appears to be fixed from my testing, but still needs exceptions to work. My example is with the latest Apple upgrades over the last couple of days, they used to fail part the way through even with exceptions, now they download without issues. The was a bug in the TCP handling by the DPI engine which appears to have been fixed.

I use allow all with the proxy but no scanning functions even if the port is not a proxied port.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Administrator User484 over 3 years ago in reply to rfcat_vk

I tried "Allow All" with "Use web proxy instead of DPI engine" uncheck, added the domain name as exception in SSL/TLS, but I still couldn't get the page...

Do I need still need to set the web proxy in the computers with DPI ?
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 3 years ago in reply to Administrator User484

No, you enable it on the XG should be enough unless you have setup the PCs with one. Please do nslookup for the web site from the XG and the pc.

ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel