Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.
Hallo and welcome to the UTM Community!
Show us a line or two from the Web Filtering log related to this issue.
Cheers - Bob
Hallo and welcome to the UTM Community!
Show us a line or two from the Web Filtering log related to this issue.
Cheers - Bob
2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="10.4.3.111" dstip="23.42.148.30" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="301" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd61cb500" url="http://officecdn.microsoft.com/db/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="0" dnstime="0" aptptime="210" cattime="192" avscantime="0" fullreqtime="95106" device="1" auth="2" ua="OfficeC2R" exceptions="av,sandbox,ssl,fileextension,size" category="105" reputation="unverified" categoryname="Business"
2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="10.4.3.111" dstip="84.53.136.11" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="416" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd7bd8300" url="http://officecdn.microsoft.com.edgesuite.net/db/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="153" dnstime="202" aptptime="229" cattime="237" avscantime="0" fullreqtime="51801" device="1" auth="2" ua="OfficeC2R" exceptions="" category="175" reputation="neutral" categoryname="Software/Hardware" content-type="application/octet-stream" reason="range"
2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="10.4.3.111" dstip="23.42.148.30" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="301" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd61cb500" url="http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="0" dnstime="0" aptptime="230" cattime="269" avscantime="0" fullreqtime="135706" device="1" auth="2" ua="OfficeC2R" exceptions="av,sandbox,ssl,fileextension,size" category="105" reputation="unverified" categoryname="Business"
2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="10.4.3.111" dstip="84.53.136.11" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="16559" request="0xd7bd8300" url="http://officecdn.microsoft.com.edgesuite.net/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="0" dnstime="184" aptptime="190" cattime="220" avscantime="11370" fullreqtime="147762" device="1" auth="2" ua="OfficeC2R" exceptions="" category="175" reputation="neutral" categoryname="Software/Hardware" sandbox="-" content-type="application/vnd.ms-cab-compressed"
2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="10.4.3.111" dstip="23.42.148.30" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="301" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd61cb500" url="http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="0" dnstime="0" aptptime="217" cattime="190" avscantime="0" fullreqtime="93672" device="1" auth="2" ua="OfficeC2R" exceptions="av,sandbox,ssl,fileextension,size" category="105" reputation="unverified" categoryname="Business"
2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="10.4.3.111" dstip="84.53.136.11" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="416" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd69f4300" url="http://officecdn.microsoft.com.edgesuite.net/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab" referer="" error="" authtime="151" dnstime="171" aptptime="192" cattime="231" avscantime="0" fullreqtime="53793" device="1" auth="2" ua="OfficeC2R" exceptions="" category="175" reputation="neutral" categoryname="Software/Hardware" content-type="application/octet-stream" reason="range"
2019:05:06-07:40:45 sto-nofw001 httpproxy[4381]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="10.4.3.111" dstip="52.109.76.35" user="NorbertS" group="GRP-INTERNET-FULL" ad_domain="STREICHER" statuscode="415" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffPolicyfull (Policy-Full)" size="0" request="0xd7bd7c00" url="https://nexus.officeapps.live.com/nexus/upload/%7b56844ED4-55EE-4027-9667-1E443E526032%7d" referer="" error="" authtime="139" dnstime="0" aptptime="3913" cattime="168" avscantime="6635" fullreqtime="176317" device="1" auth="2" ua="Microsoft Office/15.0 (Windows NT 6.2; 15.0.5119; Pro)" exceptions="" category="172" reputation="neutral" categoryname="Interactive Web Applications" sandbox="-"
Hallo edv-streicher,
Du scheinst wohl auch von der Umstellung in der UTM Architektur betroffen zu sein.
Dort geht es auch um den reason=range , wie bei Dir auch im Webfilter Log zu sehen ist.
Ist nur mit einer Ausnahme für AV-Scan zu beheben.
Gruß
DKKDG