This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Revocation data not available when filtering

Hi all. We have a group of computers that we need to lock down more than the rest of our computers. I did this with a web filtering profile applied to a group composed of 6 computers. The filter action is set to "block all content, except as specified below", and on the "websites" tab, I have a list of whitelisted websites. It works, but now, one of the websites, when it loads certain parts, keeps popping up an error saying "Revocation Information is not available". You click "Ok" 4 or 5 times, and it goes away for a while. The profile is set up as a transparent mode proxy, and on "Https", it is checked "Do not proxy HTTPS traffic in transparent mode."
Does anyone have any ideas on why this is happening?
TIA,
Brian

This thread was automatically locked due to age.

0 teched_01 over 9 years ago

Can't load Online Certificate Status Protocol (OCSP) requests or Certificate Revocation List (CRL) requests? Both ocsp and crl are good strings to search in your logs.
Cancel
Vote Up 0 Vote Down

Cancel
0 BrianRobison over 9 years ago in reply to teched_01

Can't load Online Certificate Status Protocol (OCSP) requests or Certificate Revocation List (CRL) requests? Both ocsp and crl are good strings to search in your logs.

There it is:
/var/log/http/2015/07/http-2015-07-23.log.gz:2015:07:23-15:28:27 fw-2 httpproxy[6543]: id="0060" severity="info" sys="SecureWeb" sub="http" name="web request blocked, forbidden category detected" action="block" method="GET" srcip="192.168.x.x" dstip="" user="" ad_domain="" statuscode="403" cached="0" profile="REF_HttProContaWanCityv (Training PC profile)" filteraction="REF_TrainPc (Training PC whitelist filter action)" size="3293" request="0xa31a800" url="cdp1.public-trust.com/.../6.1" exceptions="" category="178" reputation="neutral" categoryname="Internet Services" reason="category"

Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 BrianRobison over 9 years ago in reply to teched_01

Can't load Online Certificate Status Protocol (OCSP) requests or Certificate Revocation List (CRL) requests? Both ocsp and crl are good strings to search in your logs.

I'm running into a bunch of CRL and OCSP requests being blocked from godaddy, VeriSign, trustwave, digicert, symcd, omniroot, etc. I see they are in all different categories like 25, 47, 49, 178, etc. If I wanted to create a custom category just to allow this kind of traffic, what would it be under?
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 9 years ago

If I wanted to create a custom category just to allow this kind of traffic, what would it be under?
Straight from the log snippet you posted: categoryname="Internet Services"

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 BrianRobison over 9 years ago in reply to Scott_Klassen

Straight from the log snippet you posted: categoryname="Internet Services"

Ah yes. I'm slapping my forehead. Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 9 years ago

We all have those moments. [:)]

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel

0 teched_01 over 9 years ago

You may find that the "Internet Services" category encompasses substantially more than OCSP and CRL requests.

 psql -U reporting reporting -c "SELECT DISTINCT site,path,category FROM websecurity JOIN websec_reqcat ON websecurity._rowno = websec_reqcat.request WHERE websec_reqcat.category = 178 ORDER BY site, path;"