Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 24 replies
  • Subscribers 1 subscriber
  • Views 7113 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[7.500] streaming and time managed access

RFCat_vk_01
Hi,
A new version of the http proxy doesn't block users.

The streaming content is open all the time, it is an unmanaged stream in the http proxy, so effectively it bypasses the ability of timed managed access to control it.

While you might say a different http profile will fix the problem, it doesn't because there isn't a place to put streaming. Blocking a web sites (by category) that allow streaming does not work.

Ian M


This thread was automatically locked due to age.
Parents
  • 0
    Interesting.  It almost sounds like a download has begun and it continues because no  further requests are needed from the download client.  What evidence do you see in the Content Filter log?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Hi Bob,
     a fresh set from today's http log.

    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="163076824" time="3511421 ms" request="0xa5d65940" url="n44.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="183199320" time="3486652 ms" request="0xa5d660a8" url="n56.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="115645600" time="3584441 ms" request="0xa5d45890" url="n48.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="172684400" time="3558384 ms" request="0xa5d0c108" url="n54.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="243071424" time="3754786 ms" request="0xa5b4bb88" url="n38.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="257135992" time="3789717 ms" request="0xa5b34550" url="n38.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="180346600" time="3731842 ms" request="0xa5b5f590" url="n59.stagevu.com/.../x-msvideo"

    The time stamp is 56 minutes after the filter action cut off. There are no further log entries for this user after these.

    Ian M
Reply
  • 0 in reply to BAlfson
    Hi Bob,
     a fresh set from today's http log.

    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="163076824" time="3511421 ms" request="0xa5d65940" url="n44.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="183199320" time="3486652 ms" request="0xa5d660a8" url="n56.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="115645600" time="3584441 ms" request="0xa5d45890" url="n48.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="172684400" time="3558384 ms" request="0xa5d0c108" url="n54.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="243071424" time="3754786 ms" request="0xa5b4bb88" url="n38.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="257135992" time="3789717 ms" request="0xa5b34550" url="n38.stagevu.com/.../x-msvideo"
    2009:11:26-02:56:21 fw1-on-house httpproxy[18524]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.10.251" user="" statuscode="200" cached="0" profile="REF_HHUJBdVDpe (medstream)" filteraction="REF_ktWGYfeMRa (medstream)" size="180346600" time="3731842 ms" request="0xa5b5f590" url="n59.stagevu.com/.../x-msvideo"

    The time stamp is 56 minutes after the filter action cut off. There are no further log entries for this user after these.

    Ian M
Children
No Data