Microsoft ClickOnce download fails


When downloading this: (Needs to be done from Edge)

The installer starts but get's cancelled during the download.

I have tested on 3 sites all with Sophos Firewall 18.5.1, 18.5.2 and 19.0.0, all the same, disabled ips, atp, SSL/DPI the download just drops out.

Tested behind a UTM and mobile broadband also, no issues!

Here packet capture from my lab:

Look at the RST, this it where it drops.


Added TAGs
[edited by: emmosophos at 11:00 PM (GMT -8) on 4 Jan 2022]
  • Do you have Sandstorm / Zero Day protection active? 

    Where did you do this dump? Because it clearly looks like, the ACKs are not arriving on the webserver. Therefore the Firewall could drop them or the ISP. 

    If you check drop packet capture, do you see those drops? 


  • Yes it is.

    Disabled SSL/DPI, so though of Zero-Day was also disabled, but traffic was HTTP, so it intercepted anyway.

    Did exception for the domain and it solved the issue.

    tcpdump from firewall adv. shell.

    Thanks for pointing me in the right direction :-)