connection reset by peer

Question

We have basic web filtering set for clients on our domain. 
 I have a client trying to access 
 http://resources.healthequity.com/Forms/Employee_HSA_Payroll_Deduction_Form_20160504.pdf 
 If I use Policy Test to test this - the result shows as "Allowed" 
 However, the UTM blocks access and shows "Connection reset by peer" 
 When looking at the log files: 
 web request blocked" action="block" method="GET" srcip="10.153.32.64" dstip="198.17.0.21" user="rwoodbury" group="" ad_domain="AXSUNTECH" statuscode="502" cached="0" profile="REF_HttProContaInterNetwo2 (Standard Internet Profile)" filteraction="REF_HttCffVlan32Filte (VLAN 32 Filter Action)" size="2564" request="0xe0a05000" url=" resources.healthequity.com/.../Employee_HSA_Payroll_Deduction_Form_20160504.pdf" referer="" error="Connection reset by peer" authtime="56" dnstime="96" cattime="153" avscantime="0" fullreqtime="962703" device="1" auth="2" ua="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" exceptions="" category="119" reputation="neutral" categoryname="Health" 
 The category of "Health" is allowed. 
 I have also added healthequity.com to the exception list and clicked off everything except for logging. 
 Could it be the Healthequity site blocking access because the request is coming from a proxy server? 
 Any ideas? 
 Thanks 
 Tammy

darrellr · Answer

Target URL is typically in regex format: 
 ^https?://([A-Za-z0-9.-]*\.)?healthequity\.com\.?/ 
 What you had would not match the actual URL you posted in your log. Try this and see what happens. 
 Also, don't forget to enable the rule. They are disabled by default until you enable them.