Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 9 replies
  • Subscribers 3 subscribers
  • Views 7148 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web Protection makes non-blocked domain time out

Usermin

I'm having an odd issue with Web Protection causing a website to time out and never load.

The Web Protection log shows it passing the website.

 

Yet the website won't load. However, if I disable the Web Protection module, the website then loads. So it seems Web Protection is still interfering somehow.

Here's a packet capture of a session when I tried to load the site.

I tried whitelisting the domain in Web Protection, but the issue remains.

EDIT: I'm running UTM version 9.509-3.



This thread was automatically locked due to age.
Parents
  • 0

    In my observation, most major websites have embedded components from unrelated sources.   I would check the web filtering logs for something getting blocked by category, and the intrusion protection logs for something getting blocked by IPS.   IPS blocks should also produce a webfilter log entry of timeout (502 if I remember correctly), but only after a delay of up to two minutes.   I don't think I have ever seen a timeout where the only statuscode is 200.

Reply
  • 0

    In my observation, most major websites have embedded components from unrelated sources.   I would check the web filtering logs for something getting blocked by category, and the intrusion protection logs for something getting blocked by IPS.   IPS blocks should also produce a webfilter log entry of timeout (502 if I remember correctly), but only after a delay of up to two minutes.   I don't think I have ever seen a timeout where the only statuscode is 200.

Children
  • 0 in reply to DouglasFoster

    On further consideration, neither Bob's theory (AntiVirus) nor mine (IPS) fit your situation.   Since the connection is using https without inspection, these defenses would be inactive.

    Suggest you activate https inspection, and see if the additional logging gives you insight into the real problem.

  • 0 in reply to DouglasFoster

    Thanks for the suggestions. Before switching to HTTPS scanning I didn't see anything else from the Web Filter, Firewall, or IPS logs.

    Below are the results from the Web Filter log after I switched HTTPS scanning from "URL filtering only" to "Decrypt and scan".

  • +1 in reply to Usermin

    If the "504" on oplates.com isn't resolved with an Exception for antivirus, skipping the Proxy is usually the only solution.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to Usermin

    I just noticed that you have several urls with a second url embededded in the query string.   There have been other discussions in this forum indicating that this causes problems for the webfilter.   If  you have support, check with them for a bug number and to get on the notification list if it is going to be fixed.

  • 0 in reply to BAlfson

    As it happens, an exception for antivirus didn't allow the site to load, but skipping the proxy does.

    Thank you for the help.

  • 0 in reply to DouglasFoster

    DouglasFoster said:

    I just noticed that you have several urls with a second url embededded in the query string.   There have been other discussions in this forum indicating that this causes problems for the webfilter.

    Hmm, I see a query with a second URL sent to ratings-wrs.symantec.com. Is that what you were seeing?

    As far as I can see, the log says this was passed. Or am I missing something?

Unfiltered HTML