UTM running Full Transparent, web filtering not working

Until you change the subnet on eth5 so that it doesn't overlap the one on eth0, it will be difficult to draw any conclusions.  If you disabled MI2 ad immediately had a failed test, it may have been because the configuration daemon hadn't yet completed rewriting and activating the new configuration.

Cheers - Bob

I had the same issue from a customer.

Make sure, as BAlfson said, that networks should not overlap. Also make sure that both interfaces have Default gateway.

I had this issue last year and I remember the error message inside the web live log was the same.

Hope this helps!

Luk, if I understand his topology, I don't think he wants a default gateway on anything other than br0.  Right?

Cheers - Bob

Good question Bob.

I searched for my customer issue on ticketing system and he tried to configure the bridge without gateway on that bridge and web filtering stopped working.

In fact, Sophos UTM bridge uses the default gateway on the bridge interface to send URL check requests to Sophos Labs. Even if there is another interface with the same IP/Subnet as the bridge, UTM will always use the bridge gateway for URL reputation.

We need more info from Andrew however.

All interfaces other than the bridge are turned off. The bridge has a gateway defined and it is correct. The appliance has been restarted several times since the management interfaces were turned off and the appliance has been running for about a week. That should be plenty of time for the daemon to do it's thing.

Again, I respectfully remind everyone that this same configuration (other than IP addresses and subnet definitions) is working just fine on my other Sophos SG135. Either it's not a configuration issue or the other SG135 is blessed.

Scott,

did you configure the DNS Forwarded inside the UTM, so it is able to resolve dns queries?

The other option is to delete the bridge, configure only one interface and enable Web Protection and check that the engine is able to processes requests correctly.

If it works, create the bridge again.

DNS Forwarders are defined. Same ones as defined on the other SG135 that is working.

Hi Andrew,

Please check if anything is configured inside "Transparent Skip list host" found in Filtering Options> Misc. When a transparent skip list is defined it does not show up in the policy helpdesk test, reason why you might see a blocked status as the result in this check.

Thanks

Scott, I think you're telling us that you've tried hard to configure the two identically.  The rest of us participating here are trying to help you find where that's not true as this does not seem like a glitch.  If you believe that this is a glitch, you need to download some config backups that you know to be good and then re-image the device from ISO.

Cheers - Bob