Timed out Conecction

Hola Luis,

Can you find a line in the Web Filtering log where an access related to this is "blocked?"

Cheers - Bob

this is what we get in Web Filtering Log

2018:06:20-15:55:55 firewall_sophos_utm_95 httpproxy[27704]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="192.168.16.206" dstip="143.137.111.152" user="" group="" ad_domain="" statuscode="504" cached="0" profile="REF_HttProContaInterNetwo (Sistemas)" filteraction="REF_HttCffFapereyra (faSistemas)" size="2645" request="0xd8690400" url="fcmoodle.televisioneducativa.gob.mx/.../index.php" referer="" error="Timeout while reading response from Server" authtime="0" dnstime="6834" cattime="64136" avscantime="0" fullreqtime="60303038" device="0" auth="0" ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.170 Safari/537.36 OPR/53.0.2907.99" exceptions="" category="117" reputation="trusted" categoryname="Government/Military"

When you see statuscode="504", the first thing to try is an Exception for antivirus scanning.  If that doesn't work, you will need to skip the Proxy for the site. 

Does making an Exception for fcmoodle.televisioneducativa.gob.mx solve the problem?

Cheers - Bob

There is no username logged.   Are you running with Authentication = None ?

Have you checked IPS logs?   IPS blocks will cause WebFilter timeouts.

answer for Balfson; No, i already did the exception and doesnt work, this is the Exceptions list

       ^https?://([A-Za-z0-9.-]*\.)?\.fcmoodle\.televisioneducativa\.gob\.mx\.moodle\.login/

and i recently notice i have the same problem with these, these also have a Exceptions list

      ^https?://([A-Za-z0-9.-]*\.)?\.pace\.sep\.gob\.mx\.pace\.login/
      ^https?://([A-Za-z0-9.-]*\.)?\.acuerdo286\.sep\.gob\.mx/
      ^https?://([A-Za-z0-9.-]*\.)?\.acuerdo286\.sep/

 both skip list have the same config.

and question for DouglasFoster,  usually i use web filterin log and the firewall log, IPS logs ?, where can i see it? can i find it from dashboard ?

IPS = Intrusion Protection System.  The log files are with all of the others under Logging and Reporting... View Log files

It monitors incoming packets for suspicious content.   Action can be drop or alert-only.   If the packet is a reply and the the action is drop, then the requesting process (web browser, DNS client, etc.) will see a timeout because the expected reply is never received.  My logs show delays of up to 2 minutes between the IPS drop event and the webfilter timeout event.

Fortunately, the IPS logs are usually not very big, so they should be easy to review with visual inspection.

Try an Exception for 'Antivirus' only for

^https?://[A-Za-z0-9.-]*fcmoodle\.televisioneducativa\.gob\.mx

Did that work?

If not you will need to skip the proxy for that.  For the Transparent mode, put a DNS Group for fcmoodle.televisioneducativa.gob.mx in the Destination Skiplist.

Cheers - Bob

Those URLs test safe, but I get four reputation limit blocks on this URL, which appears to be a certificate revocation check: http :// crl.pki.goog/gsr2/gsr2.crl

However, I do get a page to load without any errors, and without any special handling.

Is Sophos wrong, or is the school using a compromised certificate company?

This morning, it occurs to me that a certificate revocation check only makes sense if a sites use https, but I have not seen any evidence that your target site uses encryption.   I conclude that the site is infected, and UTM is protecting you from malware, even though your specific symptoms are different from mine.   Suggest that you contact the site owner.

For BAlfson

With ^https?://([A-Za-z0-9.-]*\.)?\.fcmoodle\.televisioneducativa\.gob\.mx  we are done, it is ok now

Didn’t work what you suggest, then I used a different syntax for the skip list and neither work, then I tried something different,  I get a good result when I settled up a Download Throttling with 2048 kbit/s for each source/destination pair, and that works, right now I am using both solutions skip list and throttling but I think the solution was the Throttling

so, the next is another page but it’s the same issue, Aim receiving an “error 404”, no a Sophos error page

what is the difference between this ^https?://([A-Za-z0-9.-]*\.)?\.pace\.sep\.gob\.mx/Pace/login/

and this

^https?://([A-Za-z0-9.-]*\.)?\.pace\.sep\.gob\.mx/

why aim questioning !!, the first line works really fine, but the second did not, why if I only write (on any web browser) one part of the line like – www.pace.sep.gob.mx – doesn’t work ?, why I need to write the entire line in the skip list ? “www.pace.sep.gob/pace/login”, shouldn't work the second option ? why the UTM show a response like timed out or connection reset by peer etc. etc.

so, sorry if aim going to questioning something weird or unusual, but I keep my original concern, how in the UTM can I disable those messages “timed out” , “connection reset” o even better can I edit them to a Spanish response ?

let me explain, we knows it’s not our problem, it’s the way that page works, but the problem its turning into a big trouble for mi because the users only see a SOPHOS message and they don’t understand what it means so they are calling me for solve a problem which it’s something I cannot

I prefer just avoid those messages in that particular list or page !by de way, where can I find a "How to" for the correct syntax in exception list ? Maybe I’m missing something with that, thanks and regards

For Douglas Foster

1)       IPS didnt show any trouble

2)       What is the difference betwen work with a skip list whit all the check´s marked and only skip the antivirus protection for this page, remember the list im ussing have  the entire skip list marked

3)       Talking just about us, we are using a good certificated. i dondt know about them !

4)       About the infected site issue, we (and I mean a several other schooll´s not just us) contact that site and complain about but we have no response

sorry for any late response, but this whole school it's in maintenance mode, and we are running like crazy people with a lot of stuff

Really appreciate your help guys !