Could not open some of the websites without web proxy

Hi,

the website works for me. If you do a dns check from the XG GUI, does it get a result?
ian

DNS lookup got a result.

I tried to switch on "Use web proxy instead of DPI engine" in the firewall rule and somehow it works now. I tried to disable Web Policy on a testing firewall rules but didn't get luck.

Does it mean web traffics will still be scanned without a Web Policy ? And why that option makes a difference ?

No, you enable it on the XG should be enough unless you have setup the PCs with one. Please do nslookup for the web site from the XG and the pc.

ian

This is the nslookup from the pc,

$ nslookup rupress.org
Server:        127.0.0.53
Address:    127.0.0.53#53

Non-authoritative answer:
Name:    rupress.org
Address: 52.179.114.94

This is from the XG SSH console,

console> dnslookup host rupress.org
Domain Name Server#  127.0.0.1
Domain Name       #  rupress.org
Resolved Address 1#  52.179.114.94
Total query time  #  0.73 msec

so, now what does the logviewer show when you try to access the url?

ian

The page just didn't show. If I used wget to get the page, it waited for 1 minute and timed out.

$ wget rupress.org/.../Epigenetic-and-transcriptional-control-of
--2021-07-28 12:59:49--  rupress.org/.../Epigenetic-and-transcriptional-control-of
Resolving rupress.org (rupress.org)... 52.179.114.94
Connecting to rupress.org (rupress.org)|52.179.114.94|:443... connected.
Unable to establish SSL connection.

The only log I could find in log viewer is the log in the SSL/TLS inspection category,

2021-07-28 12:46:38SSL/TLS inspectionmessageid="19006" log_type="SSL" log_component="SSL" log_subtype="Error" severity="Information" user="" src_ip="192.168.1.239" dst_ip="52.179.114.94" user_group="" src_country="R1" dst_country="USA" src_port="41876" dst_port="443" app_name="" app_id="0" category="Health & Medicines" category_id="25" con_id="3407921152" rule_id="1" profile_id="1" rule_name="Exclusions by website or category" profile_name="Maximum compatibility" bitmask="" key_type="KEY_TYPE__UNKNOWN" key_param="Unknown" fingerprint="" resumed="0" cert_chain_served="TRUE" cipher_suite="" sni="rupress.org" tls_version="Unknown" reason="Dropped due to TLS engine error: FLOW_TIMEOUT[5]" exception="" message=""

Hi,

that result indicates you are not using the web proxy.

Ian

So with DPI Engine, I must set the web proxy on the pc ?

And if I check "Use web proxy instead of DPI engine", I don't need to set the web proxy on the pc ?

The logs and nslookup above is when I didn't tick the box for "Use web proxy instead of DPI engine" and having an exception record in the SSL/TLS exception list.

correct.

I see. Thanks.

Is it normal to have one rule for devices setting the web proxy and one rule for DPI engine ? Is there any way to distinguish the two in the firewall rules ?

Hi,

I don’t understand your request. You can only have dpi or web proxy in one firewall rule not both.

you can many rules using a mix of dpi and web proxy, really depends on what you are trying to achieve. Web proxy has more blocking functions than the dpi as you will see you get a warning about your web policy not working fully with dpi.

you will need to experiment with the dpi in your ssl/tls rule to see whether the rule passes traffic or not.

ian

Hi,

I don’t understand your request. You can only have dpi or web proxy in one firewall rule not both.

you can many rules using a mix of dpi and web proxy, really depends on what you are trying to achieve. Web proxy has more blocking functions than the dpi as you will see you get a warning about your web policy not working fully with dpi.

you will need to experiment with the dpi in your ssl/tls rule to see whether the rule passes traffic or not.

ian

Okay got it. Thanks.