connection reset by peer

We have basic web filtering set for clients on our domain.

I have a client trying to access

http://resources.healthequity.com/Forms/Employee_HSA_Payroll_Deduction_Form_20160504.pdf

If I use Policy Test to test this - the result shows as "Allowed"

However, the UTM blocks access and shows "Connection reset by peer"

When looking at the log files:

web request blocked" action="block" method="GET" srcip="10.153.32.64" dstip="198.17.0.21" user="rwoodbury" group="" ad_domain="AXSUNTECH" statuscode="502" cached="0" profile="REF_HttProContaInterNetwo2 (Standard Internet Profile)" filteraction="REF_HttCffVlan32Filte (VLAN 32 Filter Action)" size="2564" request="0xe0a05000" url="resources.healthequity.com/.../Employee_HSA_Payroll_Deduction_Form_20160504.pdf" referer="" error="Connection reset by peer" authtime="56" dnstime="96" cattime="153" avscantime="0" fullreqtime="962703" device="1" auth="2" ua="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" exceptions="" category="119" reputation="neutral" categoryname="Health"

The category of "Health" is allowed.

I have also added healthequity.com to the exception list and clicked off everything except for logging.

Could it be the Healthequity site blocking access because the request is coming from a proxy server?

Any ideas?

Thanks

Tammy