Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 23 replies
  • Subscribers 1 subscriber
  • Views 10882 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Transparent HTTPS scanning proxy profile for one client

trialrider
Hi all,

ASG in routing mode works fine. Sometimes one application has problems with getting information from it's external server through our transparent proxy. A single proxy profile using standard mode and setting up the application helped.

Now I want to try HTTPS traffic scanning. So at first I thought creating a profile for my client linked to the default action, default assignment and with HTTPS traffic scanning enabled will work.

It works without HTTPS traffic scanning. Log file shows my client goes through the defined profile but HTTPS goes through our paket filter rule.

At the second I created filter action and filter assignment completely new but HTTPS goes through pfr too.

Is there a possibility to get HTTPS traffic scanning with a transparent proxy profile enabled?

Deactivating HTTPS pfr and enabling in web proxy is no option.
-- 
Kind regards,

Steffen


This thread was automatically locked due to age.
Parents
  • 0
    Hi,

    I thought using a little profile is the easier way to try out and configure HTTPS for our clients (certs, URLs...). So I could/would take my client at first and play around with HTTPS in transparent mode, delivering certs via group policy...

    Later I would enable HTTPS scanning for all in the global settings.

    Steffen, what Bill is suggesting is that you first set up 'Web Security >> HTTP/S' as a sort of "framework" and then set up two profiles.  One profile as you have already, and another profile for everyone else.  In the second profile, you disable SSL scanning untill you are ready for everyone to use it.

    But one problem still stands: why I'm able to surf without proxy settings in my client using default transparent profile and with settings using my standard profile? Do it depends on global settings? I thought the proxy engine checks the incoming IP and looks if there a profile exists and overrides default or uses the default (global) settings.

    Can you show a line from the HTTP log demonstrating each of these situations?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Hi Bob, hi Bill

    Yes, I understand that with the two profiles and scanning enabled in global tab.

    I played around with(out) browsers proxy settings and it's behaviour again.

    At first without changing browser's proxy settings I visited wikipedia.de - Wikipedia, die freie Enzyklopdie. See attached screenshot. At second I changed browser's settings to our ASG for all services and visited wikipedia and https://www.gmx.net. And third, I disabled browser's proxy settings and visited wikipedia again.

    For all steps my proxy profile was activated with HTTPS scanning and in standard mode.

    Here are the log entries for the last step:
    2010:04:12-09:52:15 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="200" cached="0" profile="REF_NTZkryZuSH (HTTPS-Test)" filteraction="REF_fRSTWCecVE (2 - HTTPS-Test)" size="586" time="127 ms" request="0xb172bfd8" url="http://upload.wikimedia.org/centralnotice/images/2009/button-end.png" exceptions="" error="" category="177" reputation="unverified" categoryname="Content Server" content-type="image/png"
    2010:04:12-09:52:16 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="200" cached="0" profile="REF_NTZkryZuSH (HTTPS-Test)" filteraction="REF_fRSTWCecVE (2 - HTTPS-Test)" size="5567" time="432 ms" request="0xb1789558" url="http://www.wikipedia.de/img/bg_gradient_2.gif" exceptions="" error="" category="111,188" reputation="neutral" categoryname="Education/Reference,Blogs/Wiki" content-type="image/gif"
    2010:04:12-09:52:16 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="200" cached="0" profile="REF_NTZkryZuSH (HTTPS-Test)" filteraction="REF_fRSTWCecVE (2 - HTTPS-Test)" size="318" time="373 ms" request="0xb1c87958" url="http://www.wikipedia.de/favicon.ico" exceptions="" error="" category="111,188" reputation="neutral" categoryname="Education/Reference,Blogs/Wiki" content-type="image/x-icon"
    2010:04:12-09:53:17 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="6644" time="168 ms" request="0xb1e42298" url="http://www.wikipedia.de/" exceptions="" error="" category="111,188" reputation="neutral" categoryname="Education/Reference,Blogs/Wiki" content-type="text/html"
    2010:04:12-09:53:17 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="304" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="65 ms" request="0xb1e42298" url="http://www.wikipedia.de/style.css" exceptions="" error="" category="111,188" reputation="neutral" categoryname="Education/Reference,Blogs/Wiki"
    2010:04:12-09:53:17 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="304" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="65 ms" request="0xb1e8a508" url="http://www.wikipedia.de/img/fro.gif" exceptions="" error="" category="111,188" reputation="neutral" categoryname="Education/Reference,Blogs/Wiki" 
Reply
  • 0 in reply to BAlfson
    Hi Bob, hi Bill

    Yes, I understand that with the two profiles and scanning enabled in global tab.

    I played around with(out) browsers proxy settings and it's behaviour again.

    At first without changing browser's proxy settings I visited wikipedia.de - Wikipedia, die freie Enzyklopdie. See attached screenshot. At second I changed browser's settings to our ASG for all services and visited wikipedia and https://www.gmx.net. And third, I disabled browser's proxy settings and visited wikipedia again.

    For all steps my proxy profile was activated with HTTPS scanning and in standard mode.

    Here are the log entries for the last step:
    2010:04:12-09:52:15 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="200" cached="0" profile="REF_NTZkryZuSH (HTTPS-Test)" filteraction="REF_fRSTWCecVE (2 - HTTPS-Test)" size="586" time="127 ms" request="0xb172bfd8" url="http://upload.wikimedia.org/centralnotice/images/2009/button-end.png" exceptions="" error="" category="177" reputation="unverified" categoryname="Content Server" content-type="image/png"
    2010:04:12-09:52:16 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="200" cached="0" profile="REF_NTZkryZuSH (HTTPS-Test)" filteraction="REF_fRSTWCecVE (2 - HTTPS-Test)" size="5567" time="432 ms" request="0xb1789558" url="http://www.wikipedia.de/img/bg_gradient_2.gif" exceptions="" error="" category="111,188" reputation="neutral" categoryname="Education/Reference,Blogs/Wiki" content-type="image/gif"
    2010:04:12-09:52:16 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="200" cached="0" profile="REF_NTZkryZuSH (HTTPS-Test)" filteraction="REF_fRSTWCecVE (2 - HTTPS-Test)" size="318" time="373 ms" request="0xb1c87958" url="http://www.wikipedia.de/favicon.ico" exceptions="" error="" category="111,188" reputation="neutral" categoryname="Education/Reference,Blogs/Wiki" content-type="image/x-icon"
    2010:04:12-09:53:17 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="6644" time="168 ms" request="0xb1e42298" url="http://www.wikipedia.de/" exceptions="" error="" category="111,188" reputation="neutral" categoryname="Education/Reference,Blogs/Wiki" content-type="text/html"
    2010:04:12-09:53:17 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="304" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="65 ms" request="0xb1e42298" url="http://www.wikipedia.de/style.css" exceptions="" error="" category="111,188" reputation="neutral" categoryname="Education/Reference,Blogs/Wiki"
    2010:04:12-09:53:17 astaro httpproxy[4058]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***" user="" statuscode="304" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="65 ms" request="0xb1e8a508" url="http://www.wikipedia.de/img/fro.gif" exceptions="" error="" category="111,188" reputation="neutral" categoryname="Education/Reference,Blogs/Wiki" 
Children
No Data