This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

utm 9.3 causing website login invalid response error

After upgrading to 9.3 and 9.3.01 I have found a courrier website that sophos busts the login for

eTrac

doesn't matter if you type the username and password correct or not, either way it gives an error of 'invalid response'

so far creating a web proxy exception has had no effect on this.

14:11:19-09:45:05 fw httpproxy[6075]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="POST" srcip="192.168.69.135" dstip="204.193.149.161" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2629" request="0xe3b53000" url="apps.etrac.net/.../33.0" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache,fileextension,size"

This thread was automatically locked due to age.

0 Michael Dunn over 10 years ago

AFAIK this problem has not been reported to Support yet. Therefore it has not made it to Dev for investigation.
Cancel
Vote Up 0 Vote Down

Cancel
0 plcybek over 10 years ago in reply to Michael Dunn

AFAIK this problem has not been reported to Support yet. Therefore it has not made it to Dev for investigation.

How can I report that problem to Support?
I have only standard supp. license - can I (and where) create some ticket etc?
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 10 years ago

@plcybek: Contact your reseller (the entity you purchased your license/UTM from) to open up a case for you.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 plcybek over 10 years ago in reply to Scott_Klassen

@Scott_Klassen:
OK, I did that yesterday. I hope that someone will take care of that issue urgent :-/
Cancel
Vote Up 0 Vote Down

Cancel
0 Euphrates_01 over 10 years ago

This person indicates 9.305 has resolved the issue:

https://community.sophos.com/products/unified-threat-management/astaroorg/f/55/t/46580

Unfortunately, this may be the case for him/her but not for me. Currently on 9.305-4. This is still a problem.
Cancel
Vote Up 0 Vote Down

Cancel
0 MichaelMarek over 9 years ago in reply to Euphrates_01

I agree with Euphrates.

I upgraded to the latest version (9.305-4) yesterday and since then the issue has been affecting us.
Cancel
Vote Up 0 Vote Down

Cancel
0 ErikWaibel over 9 years ago in reply to MichaelMarek

I think I am getting bit by the same issue.  I upgraded to 9.304-9 yesterday and now our faculty are reporting issues with losing connection to prezi.com.  I was checking the live logs and saw many entries like this:

2015:01:16-08:49:37 oasgs httpproxy[5674]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="10.21.251.159" dstip="54.160.105.183" user="" ad_domain="" statuscode="502" cached="0" profile="REF_HttProOfaVlan2Trans (OFA (VLAN21) Transparent Proxy Profile)" filteraction="REF_HttCffOfaTranspa (OFA Transparent)" size="2701" request="0xdb3a8000" url="meeting05.prezi.com/.../5.0)" exceptions="av,content,url,ssl,cache"

I'll open up a ticket (we have premium support).  Since we run in transparent mode I'll have to try making proxy exemptions for the servers involved (looks like 12 of them just by pinging the hostnames - meeting[02-12].prezi.com)

*EDIT - UPDATE*  In my case making a proxy exception for those destination servers (we run in transparent mode) worked as a workaround.  I opened a ticket with support though as I don't want to leave that exception up permanently
Cancel
Vote Up 0 Vote Down

Cancel
0 Euphrates_01 over 9 years ago in reply to ErikWaibel

FYI, on 9.306-6 and no fix. I was able to get my transparent exceptions to work (i.e. instead of "domain.com" I needed "www.domain.com").
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 9 years ago

Guys, I don't know why everyone is posting 'Pattern version' when the issue is the version of ipsbundle. At the command line as root, check that it's 9.172 or higher:
rpm -qa | grep ipsbundle

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Euphrates_01 over 9 years ago
Guys, I don't know why everyone is posting 'Pattern version' when the issue is the version of ipsbundle. At the command line as root, check that it's 9.172 or higher:
rpm -qa | grep ipsbundle

Cheers - Bob

I removed my exception and re-tested. It still failed. Here is my ipsbundle version:

utm:/home/login # rpm -qa | grep ipsbundle
u2d-ipsbundle-9-177
Cancel
Vote Up 0 Vote Down

Cancel