Website blocked by SOPHOS

Hello Alain,

To add to what Regis and RFcat_vk had mentioned, if you create a Test Firewall without Web Policies, does the website load?

Can you confirm if the website in question is behind the XG or not, I would guess it isn’t but double confirm. 

Also, try running this command from the Advanced Shell (5>3) of the XG and show us the output.

# wget https://www.corporate.bda-net.ci

Regards,

Hello @all,

Sorry for the missing, i have been out off office for health reasons.

Thanks for the answers but i tried everything i can do, when i bypass the XG or connect from a source different of the office connection, i can reach the website.

I created an exception as shown in my above sceenshot but it doesn't work.

@Emmosophos can you show me how to run this command from the Advanced Shell (5>3) of the XG, i'm very new in Sophos XG.

Thanks in advance

Hello Alain,

Hope you’re feeling better.

Please follow this KB to SSH to the XG, once in the Advanced Shell just enter the following command:

# wget https://www.corporate.bda-net.ci

Regards,

Hello @emmosophos, thanks a lot, i'm feeling better now.

Kindly find below the output of the advanced shell wget command.

XG135_XN03_SFOS 18.0.3 MR-3# wget www.corporate.bda-net.ci
--2021-04-15 10:17:42-- www.corporate.bda-net.ci/
Resolving www.corporate.bda-net.ci... 160.154.201.99
Connecting to www.corporate.bda-net.ci|160.154.201.99|:443... failed: No route to host.
XG135_XN03_SFOS 18.0.3 MR-3#

Also notice that the ping to the url does't work too

XG135_XN03_SFOS 18.0.3 MR-3# ping www.corporate.bda-net.ci
PING www.corporate.bda-net.ci (160.154.201.99): 56 data bytes

Hi,

Could you check your netmask ?

Regards,

Hi CHRISTOPHE

Here is my netmask: 255.255.255.0

Hi CHRISTOPHE

Here is my netmask: 255.255.255.0

Hello Alain,

I have sent you a PM.

Thank you for the output of the command, it seems like you have a routing issue.

Ping doesn't work from my end  either, but the result of the command should be this:

XG125_XN03_SFOS 18.0.5 MR-5# wget http://corporate.bda-net.ci
--2021-04-15 12:54:27-- http://corporate.bda-net.ci/
Resolving corporate.bda-net.ci... 160.154.201.99
Connecting to corporate.bda-net.ci|160.154.201.99|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://www.bda-net.ci/ [following]
--2021-04-15 12:54:28-- https://www.bda-net.ci/
Resolving www.bda-net.ci... 160.154.201.99
Connecting to www.bda-net.ci|160.154.201.99|:443... connected.
ERROR: cannot verify www.bda-net.ci's certificate, issued by 'CN=GlobalSign GCC R3 DV TLS CA 2020,O=GlobalSign nv-sa,C=BE':
Unable to locally verify the issuer's authority.
To connect to www.bda-net.ci insecurely, use `--no-check-certificate'.

Regards,

Hello,

The issue got resolved by changing the Public Alias IPs to /32, they were mistakenly configured with /19 which covered also the Public IP of the External website, causing the site not to load.

Regards,