Changing from Transparent Proxy to Standard Proxy Breaks Outlook and Website Images When SSL Decrypt and Scan is Enabled

Is this a question about Web Filtering or about Webserver Protection (WAF)?

Cheers - Bob

It’s a web filtering question. Https decryption just seems to break most sites on standard proxy.  Transparent is fine.

OK, I will have moved this thread from General Discussion to the Web Protection forum.

What relevant line(s) do you see in the Web Filtering log when your browser is configured to use the Standard Proxy and website images are broken?  Are the web servers with broken images internal or out on the Internet?  What browser?  Is this the Outlook app that breaks or Outlook Web Access?

Cheers - Bob

Hi Bob,

The websites that break are out on the internet.  It seems to affect css and images.  In the logs, I can see the entry that refers to an image that won't display - this is just one example:

2019:04:01-12:25:01 utm httpproxy[5915]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.60.3" dstip="104.72.152.201" user="xxxx" group="" ad_domain="SIMS" statuscode="200" cached="0" profile="REF_HttProContaInterNetwo6 (containing IT Tech VLAN)" filteraction="REF_HttCffStaff (Staff)" size="0" request="0xc8cda700" url="ichef.bbci.co.uk/.../_106249572_upset-internet-user.jpg" referer="www.bbc.co.uk/.../business-47768666" error="" authtime="75" dnstime="6" aptptime="94" cattime="100" avscantime="0" fullreqtime="1159" device="0" auth="2" ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36" exceptions="ssl,application" category="134" reputation="neutral" categoryname="General News" country="Netherlands"

Sometimes, the web page just appears blank, sometimes, it shows but without the image and sometimes, it seems to work perfectly.  When I turn off SSL Decrypt & Scan, it always works as intended.

With regards to Outlook, it's the app that disconnects.  Again, as soon as I turn off SSL decryption, it connects again.

Thanks in advance for any advice/help.

That is not the problem entry as evidenced by theses clauses:

id="0001"
action="pass"
statuscode="200"
error=""

Capture all activity from the source IP during the test.   Many websites reference data from other servers.    

IPv6 is not active on my lab device.  decrypt and scan are selected in the Office Profile and there is no antivirus Exception.

When I go directly to the image link, I receive the image about a minute later and the following immediately appears in the logs:

If I go to the other link, the same timeout occurs and I see the image in context of the page.  My conclusion is that something is amiss with the BBC site.

Cheers - Bob

Hi Bob,

Thanks for your reply.  What doesn't make sense to me, is that the same links work perfectly when using transparent proxy, with SSL Decrypt and scan turned on.  That would seem to indicate that the BBC (and other sites) are all fine but something on the UTM is not working properly?

Cheers,

Michael

I tried to load the image - first time it didnt work, then after that it worked all the time.  Another example, if I try and access our Sophos Central portal, which is https://central.sophos.com/manage/login, with transparent mode it works fine but in standard mode with SSL decrypt turned on, all I get is a blank page.  The moment I turn SSL Decrypt off, it works perfectly.  The only log entries I get in the web filter log are like this:

2019:04:03-08:47:09 utm httpproxy[5915]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.60.3" dstip="52.31.224.234" user="xxxx" group="Domain Admins" ad_domain="SIMS" statuscode="200" cached="0" profile="REF_HttProContaInterNetwo6 (containing IT Tech VLAN)" filteraction="REF_HttCffItAdmin (IT Admin)" size="26443" request="0xd0eb7c00" url="central.sophos.com/.../" referer="" error="" authtime="0" dnstime="0" aptptime="69" cattime="103" avscantime="12140" fullreqtime="41745" device="0" auth="2" ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36" exceptions="application" category="105" reputation="trusted" categoryname="Business" sandbox="-" content-type="text/html"

Does RPR84's Outlook Exception work for you?

Cheers - Bob

Does RPR84's Outlook Exception work for you?

Cheers - Bob

Hi Bob,

The Outlook problem is on our domain Windows 10 desktops, not an app.

I don't know if it's related but I've noticed that Kerberos authentication doesn't seem to be working.  I have the UTM as our gateway (IP address) and I can access the web with SSL turned off but when I use the utm FQDN, I get an authentication failed message.  I've tried removing the UTM from the domain, deleting it in AD then rejoining but that doesn't seem to help.  Might be a completely unrelated issue!

Thanks,

Michael