Web Malware and Content Scanning - scan http logs

Question

hey guys, 
 
 when some of my games try to update (overwatch and swtor), the update fail because they cant reach the update server. 
 when i disable the http scanning on the rule to the wan, the update works. 
 
 so, where can i see the logs of packets that dropped due to http scanning (sophos engine). 
 and where can i exclude addresses if its false positive, like in this case. 
 
 thanks!

shred · Accepted Answer

You should be able to view this in the Log Viewer. From any page, on the top right corner click ‘Log Viewer’ which will open up in a new window. It defaults to the firewall logs but there’s a drop down that lets you view ‘Malware’. You might also want to check the Web Filter logs in that same drop down. 
 You can exclude specific IP addresses, domains or category of websites (as defined by Sophos) from malware scanning by going to the ‘Exceptions’ tab on the ‘Web’ page. It should be fairly self explanatory from there - create a new exception with the domain you want to exclude and make sure ‘Content and Malware scanning’ is selected to be skipped on the right side of the dialog.

shred · Answer

The ‘Invalid Traffic’ is a weird one, because that is actually “common” in the sense that you will see a lot of those entries in your firewall logs but it’s typically not an issue. There was a post about this from a Sophos employee and the recommendation was to turn off logging of ‘Invalid Traffic’ or else your firewall logs will rapidly become full of these entries. I’ll see if I can find it but bottom line, I don’t think that is your issue since turning off ‘Scan HTTP’ is fixing it. 
 When you enable ‘Scan HTTP’ on a firewall rule, this enables the Malware and Content Scanning which a part of that is using the Sophos Anti-Virus engine (default). This is all done by sending the traffic through a web proxy which alone can cause issues with some applications. My guess is your issue is from either 1) the anti virus engine or 2) that particular traffic going through the web proxy (even if its just being allowed to pass). As mentioned in my previous post, I would create an exception for that particular IP address (or preferably a domain if you can determine one since the IP address may change) to skip the ‘Malware and Content Scanning’. 
 If you enable the “Allow All” Web Policy in your firewall rule, you should be able to see all your traffic in the firewall log under “Web Filter” which can help you determine if there’s a domain being used.