Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 4 replies
  • Subscribers 0 subscribers
  • Views 18999 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Blocked Site no reason code in syslog

FGLIT

We are trialling the web appliance and are trying to access an ftp site.

If we perform a lookup the appliance is saying it's allowed - however syslog returns act=-1(blocked) and the rsn=-

Can somebody advise how to resolve this?

We have added it the local site list as a trusted site but this does not resolve it either.

:57903


This thread was automatically locked due to age.
Parents
  • 0

    Is hard to tell from the log.. but

    s=503 is the internet code 503

    act=-1 is blocked

    0x2200000006 category of Business

     rsn=-  this would normally be a number like 1406 if the category business was blocked.

    GET ftp://ftpurl/ HTTP/1.1 if this URL is an IP address you will need to make sure that  configuration / global policy / general options "allow public IP address" IS checked off.

    I understand you wanting to block everything out (I would to)  but look at those ones the target_ip= May be useful to.

    the complete log entry can be found here: http://wsa.sophos.com/docs/wsa/swa4_docs/#concepts/AppInterpretingASophosLog.htm

    ftp over port 80 IS supported, ftp over any other port will be probematic. ie 21 or 1021

    :57918
Reply
  • 0

    Is hard to tell from the log.. but

    s=503 is the internet code 503

    act=-1 is blocked

    0x2200000006 category of Business

     rsn=-  this would normally be a number like 1406 if the category business was blocked.

    GET ftp://ftpurl/ HTTP/1.1 if this URL is an IP address you will need to make sure that  configuration / global policy / general options "allow public IP address" IS checked off.

    I understand you wanting to block everything out (I would to)  but look at those ones the target_ip= May be useful to.

    the complete log entry can be found here: http://wsa.sophos.com/docs/wsa/swa4_docs/#concepts/AppInterpretingASophosLog.htm

    ftp over port 80 IS supported, ftp over any other port will be probematic. ie 21 or 1021

    :57918
Children
No Data
Unfiltered HTML