Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Subscribers 10 subscribers
  • Views 18692 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Issue with Forcepoint PAC file and Sophos

Jon Pitson

Good morning

We use Forcepoint (formerly Websense) web filtering, using a PAC file to configure proxy settings.  

The PAC file is configured, so that if we can't talk to our appliance located in the Data Center, it will failover to a web based filtering solution provided by Forcepoint .

IF in the Sophos endpoint client Real Time Scanning -> Internet is enabled,we cannot browse the internet. 
If in Sophos Cloud any options in "Real Time scanning - Internet" are checked, we cannot browse the internet.

IF in the Sophos endpoint client Real Time Scanning -> Internet is disabled OR 
in Sophos Cloud Central we set a policy where Real-time Scanning - Internet we disable Scan downloads in progress, Block access to malicious websites and Detect low-reputation files, we can browse the internet OK.

We are receiving an ERR_EMPTY_RESPONSE when we cannot browse the internet.
This is only affecting Google Chrome.  Internet Explorer and Edge can browse the internet whatever the settings above.

 

There is nothing in the events section of Sophos client when these issues occur.

In the Sophos Cloud events section for my PC, Applications svchost,chrome, swi_fc have been clocked by an endpoint firewall - however, these messages have only recently appeared - we've had the issues long before the events appeared.

I've attempted to add an exclusion for website 127.0.0.1.

 

Can anyone help?

 



This thread was automatically locked due to age.
Parents
  • 0

    Just an addition - I've checked the Sophos policy for the Windows Firewall - it's set to monitor only.

  • 0 in reply to Jon Pitson

    Hello Jon,

    We don't usually recommend having another appliance/application that does a similar function, ie Web Filtering, that Sophos would usually do since this does mean that if you have both Sophos and Forcepoint actively monitoring internet traffic on the same machine, you will start to see false positives. The option is to have one or the other, not both as both products are intercepting web traffic.

    But, moving on, can you try whitelisting your PAC file location if it has a web address or IP, if it helps at all?

    1. Go to Global Settings > Global Exclusions
    2. Click on "Add Exclusion"
    3. On "Exclusion Type:" select "Website (Windows/Mac)"
    4. On "Value:" enter the full address of the PAC file
    5. Click Add
    6. Let the Device update and test again.

    If the above does not resolve, please raise a support case and DM or post the ticket number so we are able to monitor and provide updates in this post.

Reply
  • 0 in reply to Jon Pitson

    Hello Jon,

    We don't usually recommend having another appliance/application that does a similar function, ie Web Filtering, that Sophos would usually do since this does mean that if you have both Sophos and Forcepoint actively monitoring internet traffic on the same machine, you will start to see false positives. The option is to have one or the other, not both as both products are intercepting web traffic.

    But, moving on, can you try whitelisting your PAC file location if it has a web address or IP, if it helps at all?

    1. Go to Global Settings > Global Exclusions
    2. Click on "Add Exclusion"
    3. On "Exclusion Type:" select "Website (Windows/Mac)"
    4. On "Value:" enter the full address of the PAC file
    5. Click Add
    6. Let the Device update and test again.

    If the above does not resolve, please raise a support case and DM or post the ticket number so we are able to monitor and provide updates in this post.

Children
Unfiltered HTML