This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM and Office 2013 auto-updates

I think Sophos UTM is blocking Office 2013 automatic updates. All clients don't seem to get the updates. Are there some exceptions or firewall rules I need to define? Thanks.


This thread was automatically locked due to age.
Parents Reply Children
  • Here the log file

    2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="10.4.3.111" dstip="23.42.148.30" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="301" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd61cb500" url="http://officecdn.microsoft.com/db/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="0" dnstime="0" aptptime="210" cattime="192" avscantime="0" fullreqtime="95106" device="1" auth="2" ua="OfficeC2R" exceptions="av,sandbox,ssl,fileextension,size" category="105" reputation="unverified" categoryname="Business"
    2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="10.4.3.111" dstip="84.53.136.11" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="416" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd7bd8300" url="http://officecdn.microsoft.com.edgesuite.net/db/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="153" dnstime="202" aptptime="229" cattime="237" avscantime="0" fullreqtime="51801" device="1" auth="2" ua="OfficeC2R" exceptions="" category="175" reputation="neutral" categoryname="Software/Hardware" content-type="application/octet-stream" reason="range"
    2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="10.4.3.111" dstip="23.42.148.30" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="301" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd61cb500" url="http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="0" dnstime="0" aptptime="230" cattime="269" avscantime="0" fullreqtime="135706" device="1" auth="2" ua="OfficeC2R" exceptions="av,sandbox,ssl,fileextension,size" category="105" reputation="unverified" categoryname="Business"
    2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="10.4.3.111" dstip="84.53.136.11" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="16559" request="0xd7bd8300" url="http://officecdn.microsoft.com.edgesuite.net/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="0" dnstime="184" aptptime="190" cattime="220" avscantime="11370" fullreqtime="147762" device="1" auth="2" ua="OfficeC2R" exceptions="" category="175" reputation="neutral" categoryname="Software/Hardware" sandbox="-" content-type="application/vnd.ms-cab-compressed"
    2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="10.4.3.111" dstip="23.42.148.30" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="301" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd61cb500" url="http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="0" dnstime="0" aptptime="217" cattime="190" avscantime="0" fullreqtime="93672" device="1" auth="2" ua="OfficeC2R" exceptions="av,sandbox,ssl,fileextension,size" category="105" reputation="unverified" categoryname="Business"
    2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="10.4.3.111" dstip="84.53.136.11" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="416" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd69f4300" url="http://officecdn.microsoft.com.edgesuite.net/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="151" dnstime="171" aptptime="192" cattime="231" avscantime="0" fullreqtime="53793" device="1" auth="2" ua="OfficeC2R" exceptions="" category="175" reputation="neutral" categoryname="Software/Hardware" content-type="application/octet-stream" reason="range"
    2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="10.4.3.111" dstip="52.109.76.35" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="415" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd7bd7c00" url="https://nexus.officeapps.live.com/nexus/upload/%7b56844ED4-55EE-4027-9667-1E443E526032%7d" referer="" error="" authtime="139" dnstime="0" aptptime="3913" cattime="168" avscantime="6635" fullreqtime="176317" device="1" auth="2" ua="Microsoft Office/15.0 (Windows NT 6.2; 15.0.5119; Pro)" exceptions="" category="172" reputation="neutral" categoryname="Interactive Web Applications" sandbox="-"

  • Hallo edv-streicher,

    Du scheinst wohl auch von der Umstellung in der UTM Architektur betroffen zu sein.

    Schau mal hier rein:
    https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/109090/partial-content-range-rejected-by-proxy-after-upgrading-to-9-6#pi2353=2

    Dort geht es auch um den reason=range , wie bei Dir auch im Webfilter Log zu sehen ist.

    Ist nur mit einer Ausnahme für AV-Scan zu beheben.

    Gruß
    DKKDG