Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Subscribers 26 subscribers
  • Views 8706 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HTTP Error 502 Inflation failure, invalid content when in Chrome and searching on google.ca/om

DevonNoonan

Hi Folks,

I am seeing a weird error with Chrome only since Monday morning; when trying to search (either through the bar or first navigating to google.com or .ca) I will receive a HTTP Status Code 502 Inflation failure, invalid content.

The facts so far:

  • XG210 on 15.01.0 MR-3
  • I am connecting over HTTPS
  • This does not occur in IE or Firefox. My Chrome version is 54.0.2840.71 m
  • This does not occur if HTTPS scanning is off and will not re-occur after it has been turned back on until the browser has been closed and reopened or a certain amount of time has passed. Even if I open a new tab and search after scanning has been re-enabled it will work
  • I was the first person to notice the issue but it has spread. It is not limited to one rule.
  • I am already dropping QUIC traffic
  • My patterns are all up-to-date and I last checked today at 3pm
  • I have the CA installed in my OS/Browser. Removing the CA causes the standard NET::ERR_CERT_AUTHORITY_INVALID HSTS related error.
  • Re-adding the cert freshly downloaded from the SF doesn't help
  • The clock on the Sophos is in sync with my computer
  • A packet capture via the WebUI yields no clues. It simply tells me which rule it went through but no drops/invalids etc.
  • A drop-packet-capture yields nothing

This was working perfectly fine for several weeks. I have noticed other folks with some other 502 errors (Bad Gateway, Proxy Timeout, etc.) but none of the fixes there seem to have works (i.e making sure your patterns are up to date).

Anyone have any clues or tips?

I am playing phone tag with Sophos support so I thought I'd ask here in the mean time.

 

Thanks,

Devon

 



This thread was automatically locked due to age.
  • 0

    Devon,

    I have seen this error on Firefox after the v16.01.1 where the certificate has been generated by the appliance but the old certificate was still used inside the Browser.

    What I suggest to you is to upgrade to latest version (16.01.1), download and import the CA used for Web Filtering Scan and see if the problem exists.

    v16 has a better log management and troubleshooting.

    Thanks

  • 0

    Hi Devon,

    Take SSH to XG and go to option 5. >3. Advance Shell. Execute the command,

    cd /log

    tail -f *.log | grep decompression

    Navigate to several website on Chrome, capture the output and post it here.

    Thanks

  • 0 in reply to sachingurung

    Thanks for the reply guys!

    I tailed the logs and for each refresh I had this line pop up:

    1477580081.021628784 [11374/0x7fc905300000] scanner.c:629 get_decompress_mask No decompression due to an unrecognized compress method: sdch

    I had left it running and got this while trying to sign in to Dell's Premier Portal:

    1477580292.249856562 [11375/0x7fc90676a000]       scanner.c:629   get_decompress_mask No decompression due to an unrecognized compress method: br

    Thanks,
    Devon

  • +1 in reply to DevonNoonan

    Hi Devon,

    The issue is related to the latest version update on Chrome which uses Brotli compression.

    The compression type is included in our latest firmware SF-OS v16 Beta 3, if you are on the previous version then an upgrade should resolve the issue.

    The issue reported under NC-10637 and if the upgrade does not resolve the issue then I suggest you to report this to our Support team to investigate further.

    Thanks

  • 0 in reply to sachingurung

    Finally got it upgraded to v16 and it's working fine again. Thanks!