Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 1 subscriber
  • Views 7191 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Allow Norton Antivirus LiveUpdate through Web Protection

r3gan
Hi all,

I've done some searching in the forums here on this topic, but can't find any relevant threads except for the one about using the web proxy in Standard mode.

We have a UTM425, running Sophos release 9.111, and have web filtering turned ON in Transparent mode.  None of the Norton Antivirus programs are able to connect to LiveUpdate anymore.  The error is the same as the other post I found; "there is a problem connecting to the LiveUpdate server".  If I disable the web filtering option in the UTM425, then the clients can successfully connect and update.  I have tried putting URL exceptions in for symantec.com and symantecliveupdate.com but neither of these help.  

Has anyone else had this problem?  Can you offer suggestions to fix it?

Thanks!


This thread was automatically locked due to age.
  • 0 in reply to BAlfson
    R3gan, please post a "pass" line where the Exception wasn't triggered.  I bet we can tell you another thing to look for...

    Cheers - Bob


    Here's one:
    [FONT="Courier New"]2014:11:25-00:00:06 utm425 httpproxy[5761]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.5.2" dstip="184.150.187.81" user="" ad_domain="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="1" request="0x11ebc7b0" url="http://liveupdate.symantecliveupdate.com/minitri.flg" exceptions="" error="" authtime="0" dnstime="458" cattime="0" avscantime="1066" fullreqtime="47963" device="0" auth="0" country="Canada" content-type="text/plain" application="symupdat" app-id="1178"[/FONT]

    Notice the [FONT="Courier New"]exceptions=""[/FONT] ... after I deleted and re-added the exception record, that log line field is no longer empty.
  • 0
    Wow - I guessed wrong!  If you have a paid subscription, please have this reported as a possible bug if you're not still on 9.111.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML