Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 20 replies
  • Subscribers 40 subscribers
  • Views 3111 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Could not open some of the websites without web proxy

Administrator User484

Hi.

I'm recently failed to open some of the websites when behind the XG Firewall, but when I set the web proxy on the computer to the firewall, it worked. The links are valid and normal I believe, like,

rupress.org/.../Epigenetic-and-transcriptional-control-of

I couldn't even install Sophos Intercept X with SophosSetup.exe last night. I checked the log and it couldn't access the Sophos website for downloading the installation files.

I couldn't also connect to WebEx few hours ago with web proxy.

What I tried,

1. setting an empty firewall rules without adding any polices and allowing all connections

2. adding the domains to exception list

3. stopping the SSL scan

But nothing worked. It affects only the LAN but not the connections through VPN.

P.S. I didn't realize XG and UTM are two different types of firewalls, I made a mistake a posted on UTM, community.sophos.com/.../474280



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Administrator User484

    I've just upgraded to 18.5 but I still found that my testing firewall rules with checking anything inside the "Web Filtering" section didn't work. But if I set the Web Policy to "Allow All" and check the "Use web proxy instead of DPI engine", I could access the websites just like before. I wonder what is the difference between "None" and "Allow All" ?

  • 0 in reply to Administrator User484

    None, will use the default SSL/TLS inspection whereas allow all allows you to select the proxy. The DPI engine appears to be fixed from my testing, but still needs exceptions to work. My example is with the latest Apple upgrades over the last couple of days, they used to fail part the way through even with exceptions, now they download without issues. The was a bug in the TCP handling by the DPI engine which appears to have been fixed.

    I use allow all with the proxy but no scanning functions even if the port is not a proxied port.

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    I tried "Allow All" with "Use web proxy instead of DPI engine" uncheck, added the domain name as exception in SSL/TLS, but I still couldn't get the page...

    Do I need still need to set the web proxy in the computers with DPI ?

  • 0 in reply to Administrator User484

    No, you enable it on the XG should be enough unless you have setup the PCs with one. Please do nslookup for the web site from the XG and the pc.

    ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    This is the nslookup from the pc,

    $ nslookup rupress.org
    Server:        127.0.0.53
    Address:    127.0.0.53#53

    Non-authoritative answer:
    Name:    rupress.org
    Address: 52.179.114.94

    This is from the XG SSH console,

    console> dnslookup host rupress.org
    Domain Name Server#  127.0.0.1
    Domain Name       #  rupress.org
    Resolved Address 1#  52.179.114.94
    Total query time  #  0.73 msec

  • 0 in reply to Administrator User484

    so, now what does the logviewer show when you try to access the url?

    ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    The page just didn't show. If I used wget to get the page, it waited for 1 minute and timed out.

    $ wget rupress.org/.../Epigenetic-and-transcriptional-control-of
    --2021-07-28 12:59:49--  rupress.org/.../Epigenetic-and-transcriptional-control-of
    Resolving rupress.org (rupress.org)... 52.179.114.94
    Connecting to rupress.org (rupress.org)|52.179.114.94|:443... connected.
    Unable to establish SSL connection.

    The only log I could find in log viewer is the log in the SSL/TLS inspection category,

    2021-07-28 12:46:38SSL/TLS inspectionmessageid="19006" log_type="SSL" log_component="SSL" log_subtype="Error" severity="Information" user="" src_ip="192.168.1.239" dst_ip="52.179.114.94" user_group="" src_country="R1" dst_country="USA" src_port="41876" dst_port="443" app_name="" app_id="0" category="Health & Medicines" category_id="25" con_id="3407921152" rule_id="1" profile_id="1" rule_name="Exclusions by website or category" profile_name="Maximum compatibility" bitmask="" key_type="KEY_TYPE__UNKNOWN" key_param="Unknown" fingerprint="" resumed="0" cert_chain_served="TRUE" cipher_suite="" sni="rupress.org" tls_version="Unknown" reason="Dropped due to TLS engine error: FLOW_TIMEOUT[5]" exception="" message=""

  • 0 in reply to Administrator User484

    Hi,

    that result indicates you are not using the web proxy.

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    So with DPI Engine, I must set the web proxy on the pc ?

    And if I check "Use web proxy instead of DPI engine", I don't need to set the web proxy on the pc ?

  • 0 in reply to Administrator User484

    The logs and nslookup above is when I didn't tick the box for "Use web proxy instead of DPI engine" and having an exception record in the SSL/TLS exception list.

Unfiltered HTML