Sophos UTM 9 akamai

Add a web filtering exception for akamaiedge.net

It's always tempting to block the akamai stuff, but it's such a large hosting that major players and solutions use it to host.

Many thanks for your answer.

If the webfiltering log is showing the ip for an akamai  server , would the exception have to include the ip ranges of akamai?

No just the DNS name, the UTM will resolve the IPs like it does the NTP pool.  You will have to add it as a DNS Group rather than a single one.  As an example, zoom.us is in my UTM has a DNS Group, and has 22 IPs:

Within your log you can see url="">https://2.19.154.55/" ...
Once again, one of those great programmers managed to use the IP address instead of the FQDN within the call.
You probably won't even get a valid certificate for this IP.
The current certificate is issued to "https://*.concursolutions.com" which does not match "">https://2.19.154.55".
Sophos SG does a great job blocking these request ...

... but you may create the exception for Host with IP "2.19.154.55"

PS: your try to access "">eu1.concursolutions.com/"  hit IP dstip="104.103.204.76" ... which is a completely different IP as used by the App (2.19.154.55).

Within your log you can see url="">https://2.19.154.55/" ...
Once again, one of those great programmers managed to use the IP address instead of the FQDN within the call.
You probably won't even get a valid certificate for this IP.
The current certificate is issued to "https://*.concursolutions.com" which does not match "">https://2.19.154.55".
Sophos SG does a great job blocking these request ...

... but you may create the exception for Host with IP "2.19.154.55"

PS: your try to access "">eu1.concursolutions.com/"  hit IP dstip="104.103.204.76" ... which is a completely different IP as used by the App (2.19.154.55).

Thanks you for your input ,  what I don't understand  is,  if I send the same  traffic to a simple squid proxy server with  eu1.concursolutions.com  whistelisted,  everything works fine.  I do not have to  specify any ip's in the white list,   e.g. akamai or others.

Yes, please compare ...

If You call the page/site/URL you use the name of the server url="http://eu1.concursolutions.com/"  like within your first log

2022:02:18-11:08:50 utm httpproxy[8987]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="x.x.x.x." dstip="104.103.204.76" user="" group="" ad_domain="" statuscode="301" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffWhitelist (Whitelist)" size="0" request="0xdbbeca00" url="http://eu1.concursolutions.com/" referer="" error="" authtime="0" dnstime="187" aptptime="0" cattime="13174" avscantime="0" fullreqtime="25708" device="0" auth="0" ua="Wget/1.20.3 (linux-gnu)" exceptions="" overridereputation="1" category="105" reputation="trusted" categoryname="Business"

while the App call url="">https://2.19.154.55/"

2022:02:18-10:59:45 utm httpproxy[8987]: id="0060" severity="info" sys="SecureWeb" sub="http" name="web request blocked, forbidden category detected" action="block" method="CONNECT" srcip="x.x.x.x" dstip="" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffWhitelist (Whitelist)" size="3182" request="0xa732000" url="">https://2.19.154.55/" referer="" error="" authtime="0" dnstime="0" aptptime="0" cattime="81" avscantime="0" fullreqtime="213448" device="0" auth="0" ua="" exceptions="" category="9998" reputation="unverified" categoryname="Uncategorized" reason="category"

Hi Dirk; The app  always calls  "http://eu1.concursolutions.com/  ..

If I set the app proxy server setting to use the  squid proxy server  , which has whitelist  eu1.concursolutions.com, the app works,

If I remove the proxy server setting on the same app,  it  routes out via the SOPHOS  UTM .  The ip's of eu1.concursolutions.com appear in the web filtering logs.   I  have to whitelist the ip's of   eu1.concursolutions.com on the UTM  and can't get away with just whitelisting eu1.concursolutions.com , like I do on the squid proxy 

Really appreciating your help Dirk

... and if you configure the UTM as Proxy within the app?

I'm about to look a trying that. Need to work out the  port.

FYI The Webfiltering -> GLOBAL setting -> is transparent mode  , and I thought using a proxy setting is not relevant is this mode.

the standard mode is still active in the background
the port can be found somewhere in the settings