Sophos UTM 9 - This site can’t be reached / took too long to respond / Connection to server timed out

Question

Good Afternoon, 
 
 I am having difficulties with handful of websites not loading, giving one of the following error messages, 
 
 This site can&rsquo;t be reached 
 Took too long to respond 
 Connection to server timed out 
 
 Websites 
 
 https://personnelchecks.employmentcheck.org.uk/ (This is the website used for testing this issue) 
 http://www.screwfix.com/ 
 http://www.diy.com/ 
 
 These sites are working outside of this network. 
 
 Sophos Sepcs: 
 Model: SG115w 
 Subscriptions: Base Functionality, Email Protection, Network Protection, Web Protection, Webserver Protection, Wireless Protection, Endpoint AntiVirus 
 Firmware version: 9.411-3 
 
 Error: 
 2017:07:12-12:26:42 utm httpproxy[4018]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="CONNECT" srcip="172.16.1.2" dstip="194.154.170.15" user="" group="" ad_domain="" statuscode="500" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="226" request="0xe2589e00" url=" personnelchecks.employmentcheck.org.uk/" referer="" error="Connection timed out" authtime="0" dnstime="7" cattime="34956" avscantime="0" fullreqtime="127313170" device="0" auth="0" ua="Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" exceptions="" overridereputation="1" category="105" reputation="trusted" categoryname="Business" 
 
 Screen Shot: 
 
 Testing Completed So Far 
 So Far I have completed the following: 
 
 Removed the web filtering all together 
 Added Whitelisting 
 Added Exceptions to the firewall 
 https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/74018/categorization-sometime-fails---long-loading-time-of-website 
 
 I have reverted all this testing back to the original state 
 
 Previous Error 
 Previously we had an error with our ISP forwarders being incorrect however this was months ago and seems to not be the reason for this error. 
 
 I am at a loss as to where this is getting blocked or why it is not working properly, any help would be much appreciated. 
 
 Kind Regards 
 
 Peter

BAlfson · Answer

I'm confused by your comment about DNS requests... 
 In Transparent mode, all DNS requests are made by the browser before the browsing request is sent through the UTM, and the Transparent Proxy makes none. In this mode, the Transparent mode skiplists determine which traffic skips the Proxy. 
 In Standard mode, the browser doesn't request name resolution, the Proxy does. In this mode, the 'Exceptions' in 'Proxy Settings' in the Browser determine which traffic skips the Proxy. 
 If the Default Profile is your only Profile and it is in Transparent mode, it will react as if in Standard mode if the browser sends a port 8080 request to the IP of "Internal (Address)" instead of resolving the FQDN itself and sending port 80 traffic to the website address. 
 If 'Automatically detect settings' is selected in the 'LAN Settings' of the browser, it's likely that the browser is addressing the Proxy in Standard mode, so do not select 'Automatically detect settings' if you want to use Transparent mode. 
 Cheers - Bob

Peter Charlton · Answer

I have left this job now and can no longer give a right or wrong answer to this solution.