Antivirus blocking all ReverseProxy/WAF requests

Hi Sam,

Which is the AV engine selected? Make sure it is set to AVIRA.

Any help?

sachingurung,

I have changed the AV engine to AVIRA and still the issue persists; we are still experiencing periods where the Reverse Proxy responds with HTTP code 400 to all requests.

Please escalate this to your product engineers to see if the issue can be replicated. Also if you'd like log files of the behavior please see your support@sophos.com email, I have sent many log file snippets... (and, not surprisingly, I have not heard back for several weeks now!!)

Cheers

Sam, this isn't the place to communicate with Sophos Support.  If you have a case #, send an email asking for immediate escalation.  If you don't have a case # and you don't have Premium Support, ask your reseller to get a case open (we do this for no charge for our customers).  If you have Premium Support, Open a ticket with Sophos Support at https://secure2.sophos.com/en-us/support/contact-support.aspx or https://myutm.sophos.com/supportCases.php.

Cheers - Bob

I have contacted Sophos Support multiple times regarding this Virus flagging issue.  Each time I request escalation, but after the initial response they simply did not reply to my follow-ups.  Yes, case #'s were opened, and yes, case #'s were ignored by the Sophos support team.

I am completely upset with Sophos Support over this issue, because of the general Lack of Support.

In situations where one has a unique problem, there are three steps to take, in order from the least to the most disruptive:

1. Make a new configuration backup and then restore one from before the Up2Date after which your problems began.
2. Reboot the UTM.
3. Take several backups off the UTM if you don't have them sent to you on a daily basis, reload the UTM from ISO and restore the most-recent backup.

I'm guessing they recommended #3 already and that you don't want to do that as you lose logs, Reporting and graphs.  You can export the logs to your PC with WinSCP, but there's no way to save graphs and reporting.

If the third solution doesn't fix the problem, you will have re-energized your claim to escalation.

Cheers - Bob

None of those options are realistic in a top-end production Web Application environment, mostly because A) there have been numerous unrelated production configuration changes that have been made since the events began, and restoring an old config would undo those production config changes - and B) Rebooting the UTM has already happened when the firmwares were updated after the events began.

Since we are in a Highly Available production environment with active-passive HA nodes, I might be able to destroy the cluster and restore just one node using our USB Smart Installer.  This, of course, creates a single point of failure in the production environment which makes this solution not very attractive.

I would hate to think that reinstalling from ISO is Sophos's official solution to me (they haven't suggested it as of Jan 9, the last I heard from them).  Instead, I would imagine they would give me confirmation that the Product Engineers have reviewed my log files that I sent them, and that they either A) know what the issue is and they are researching why it's happening or B) need to contact me directly for more information or clarification.  Obviously, none of those things has happened, and that's why I began this discussion on the Sophos Community.

In fact at this point, I'm reckoning Sophos's Support system as bush league (read: second-rate).  I've even politely asked to collaborate with the supervisors/managers of the support team and I received crickets.  Completely unimpressed.

You have a PM, Sam.

Cheers - Bob

Hi Sam,

I will take care that the case gets a proper escalation and support. Can you just PM me the license number, I can't take any further step towards support unless you are having a paid subscription.

Alongside, can you also post the reverseproxy logs  for us to investigate.

Thanks

Hi Sam,

I will take care that the case gets a proper escalation and support. Can you just PM me the license number, I can't take any further step towards support unless you are having a paid subscription.

Alongside, can you also post the reverseproxy logs  for us to investigate.

Thanks