This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Website get blocked for no reson

Hi,

one of our users today couldnt open a web site,but after login and logout (as he said) he could open the same website. I did check the web application logs and yes there I could see that the website was bloked:

2015:09:16-15:23:16 security1-2 httpproxy[9524]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="10.0.10.239" dstip="193.XX.XX.7" user="" ad_domain="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2517" request="0xde055000" url="www.somedoain.be/.../7.0; .NET4.0E; .NET4.0C)" exceptions="" category="108" reputation="trusted" categoryname="Public Information" country="Belgium" country="Belgium"

I did check the default policy and olny Drugs and nudity is blocked. I did run the policy tester and run use the same link and it says ALLOWED.

why it get blocked?

This thread was automatically locked due to age.

0 xGreg over 9 years ago

Which FW version are you using? Are you authenticated throughAD?

The same thing is happening to us. Our UTM log show the same thing (user="" ad_domain="") with some users and they get "authentication failed". I don't know why the proxy isn't seeing some users. The thing is, sometimes the user can browse again (without do nothing) and sometimes we restart the PC/Windows and can browse internet again.

This issue started two days ago. Maybe the last FW version is generating it somehow?

PD. Sorry I'm not trying to hijack your thread. Maybe our problems are related with yours.
Cancel
Vote Up 0 Vote Down

Cancel
0 DarkKnight93 over 9 years ago

country="Belgium" country="Belgium"
Do you have any Country blocking enabled?

just a quick shot
Cancel
Vote Up 0 Vote Down

Cancel
0 vilic over 9 years ago

For status codes 502 & 504 try to create exceptions from AV scanning and SSL filtering.
Cancel
Vote Up 0 Vote Down

Cancel
0 teched_01 over 9 years ago

Aresh: From your log line, error="Connection refused".
Cancel
Vote Up 0 Vote Down

Cancel
0 Aresh over 9 years ago

Hi everone,

Thanks you for your answers.

because the above URL is a valid url, so I did add this url to the allow the website list.
and now everything works.
but why the default filter did block the website in the first place I really dont have an answer for it.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 DarkKnight93 over 9 years ago

have you checked wether you block Belgium in Network Protection -> Country Blocking?
Cancel
Vote Up 0 Vote Down

Cancel
0 Aresh over 9 years ago in reply to DarkKnight93

Yes I did check and it is not block any country
Cancel
Vote Up 0 Vote Down

Cancel