This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

windowsupdate fails

Symptoms:
WSUS and manual Windows Update are extremely slow to such a degree that they fail or are otherwise unusable. Downloading .exe, .cab, and so on from other urls then 'download.windowsupdate.com' works just fine.

Situation:
Astaro configuration in question worked fine for months on ends. Now, even with all sorts of exceptions and temporary reconfigurations (like turning AntiVirus and everything else off and/or allowing everything), nothing seems to work.
Astaro HTTP Proxy is in Transparent Operation Mode with Full Transparent Mode turned off. It does not matter if the WSUS server is configured for either proxy use or no proxy use. Outcome is the same. Same goes for using BITSADMIN to force BITS downloads into either proxied or non proxied mode, foreground or background mode.

Assumptions:
It looks like that the Astaro applies a rule set found under the HTTP/S Menu (it does mention all the Exceptions made there), but also applies the rule set found under the HTTP/S Profiles Menu (Default Content Filter Action). However, both are manually configured to always allow 'download.windowsupdate.com'.
Compare these two log entries. What's the difference here? Why is one blocked and the other allowed?

2010:10:15-10:06:05 ASG110 httpproxy[3948]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***.***.***.***" user="" statuscode="206" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="265777" time="63914 ms" request="0xaf4aafc8" url="download.windowsupdate.com/.../mpam-d_0e36f3ec55d288cd9a4a264044d5c37cbc417e48.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-10:19:29 ASG110 httpproxy[3948]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="175404" time="100574 ms" request="0x8cbe8e8" url="download.windowsupdate.com/.../mpam-d_49cac6018dc3364bf4b9ab8596812579842dfce8.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

Question:
How do I force the Astaro to always allow everything that comes from 'download.windowsupdate.com' in whatever shape or form? No matter what the Astaro might think of it.

Here are some more Log File entries:

2010:10:15-10:06:05 ASG110 httpproxy[3948]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***.***.***.***" user="" statuscode="206" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="265777" time="63914 ms" request="0xaf4aafc8" url="download.windowsupdate.com/.../mpam-d_0e36f3ec55d288cd9a4a264044d5c37cbc417e48.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-10:06:12 ASG110 httpproxy[3948]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="376 ms" request="0xaf4aafc8" url="download.windowsupdate.com/.../mpam-d_49cac6018dc3364bf4b9ab8596812579842dfce8.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""



2010:10:15-10:07:38 ASG110 httpproxy[3948]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="31524" time="86258 ms" request="0xaf4aafc8" url="download.windowsupdate.com/.../mpam-d_49cac6018dc3364bf4b9ab8596812579842dfce8.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-10:17:49 ASG110 httpproxy[3948]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="59282" time="140701 ms" request="0xaf464758" url="download.windowsupdate.com/.../mpas-fe_c638d2152c77a9a6a518bf2476905bb46e24c0a6.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""



2010:10:15-10:18:23 ASG110 httpproxy[3948]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***.***.***.***" user="" statuscode="206" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="17450" time="19263 ms" request="0x8d034e8" url="download.windowsupdate.com/.../asentdat-x64-3.3.9406.504_c11967d45df85ad2419c6c6aa9704f215f0e2cd7.cab" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-10:18:32 ASG110 httpproxy[3948]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="330 ms" request="0x8d034e8" url="download.windowsupdate.com/.../am_delta_patch1_2f20263612d03864fa61378cccb9bcbe8671bed2.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""



2010:10:15-10:19:29 ASG110 httpproxy[3948]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="175404" time="100574 ms" request="0x8cbe8e8" url="download.windowsupdate.com/.../mpam-d_49cac6018dc3364bf4b9ab8596812579842dfce8.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""



2010:10:15-10:19:33 ASG110 httpproxy[3948]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="79760" time="60675 ms" request="0x8d034e8" url="download.windowsupdate.com/.../am_delta_patch1_2f20263612d03864fa61378cccb9bcbe8671bed2.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-10:19:42 ASG110 httpproxy[3948]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="326 ms" request="0x8d034e8" url="download.windowsupdate.com/.../am_delta_patch1_f8b5c64c93896d8317168959172beb7e080f8fa0.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""



2010:10:15-10:20:35 ASG110 httpproxy[3948]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="89150" time="78819 ms" request="0xaf4e9600" url="download.windowsupdate.com/.../mpam-fe_325e5902254c107558ea41e6cc6827a072d4671d.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-10:21:19 ASG110 httpproxy[3948]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="72480" time="96755 ms" request="0x8d034e8" url="download.windowsupdate.com/.../am_delta_patch1_f8b5c64c93896d8317168959172beb7e080f8fa0.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

This thread was automatically locked due to age.

0 BAlfson over 15 years ago

action="pass" [...] size="79760" time="60675 ms"

That's a sign that the proxy isn't working well with the windowsupdate site. The blocked lines all show this. Anytime something changes unexpectedly, it pays to check the Intrusion Prevention log.

It does not matter if the WSUS server is configured for either proxy use or no proxy use. Outcome is the same.

Do you mean that the downloads to the WSUS server are slow, or that the uploads to local PCs from the WSUS are slow? If the latter, you might want to set all PCs to access local IPs directly rather than via the Astaro Proxy.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Arthur.Bommele over 15 years ago
Thank you for your reply.

I've seen the excessive time periods as well. Not just specific to 'download.windowsupdate.com' but other sites as well. It's as if something internal to the Astaro is choking on something. Perhaps backlogging like mad. Can't find anything in any log that might indicate that though.
Question remains why 'download.windowsupdate.com' gets the brunt of it. And how to force the Astaro to accept anything from 'download.windowsupdate.com' no matter what.

There's nothing relevant in the Intrusion Prevention log.
The issue is downloading from the Internet to WSUS or PC's doing a manual Windows Update.
And now it seems downloading whatever is a problem.

Astaro CPU at 22%. RAM at 85%.

Here's what happens when WSUS itself downloads something.

2010:10:15-16:41:29 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="131761" time="103603 ms" request="0xa552ba70" url="download.windowsupdate.com/.../mpam-d_49cac6018dc3364bf4b9ab8596812579842dfce8.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

Manually downloading the same url from the same source ip using Internet Explorer starts the download (you can see the progress bar) but results in an average download speed of 244 bytes/Sec so unusable.

However, manually downloading http://download.microsoft.com/download/9/5/D/95D3883A-00A2-4A8A-A979-48D5AB9B1112/Windows7UpgradeAdvisorSetup.exe leads to http://passthrough.fw-notify.net/static/819158/downloader.js coming into view. Very rapidly downloading the requested file, taking some time to scan the file for viruses, to then offer the Astaro screen to right click the icon and "Save Target As". However, when I do that at first a very fast downloads starts but that soon caves in to turtle speed. Much later ending in "The connection with the server was reset".

2010:10:15-18:15:18 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="7335 ms" request="0xa2456c60" url="download.microsoft.com/.../octet-stream"

2010:10:15-18:34:31 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="442380" time="550179 ms" request="0xa2601b78" url="download.microsoft.com/.../octet-stream"

So what logic makes the Astaro decide to mostly block GET requests to 'download.windowsupdate.com' but pass GET requests to 'download.microsoft.com' and in all cases be dead slow to download such files to the end node?
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 15 years ago

Since there's nothing in the IPS log, I think you should ask your reseller to open a support request to Astaro.

You likely can create a workaround while waiting for someone to look at your device; create DNS Group network definitions like "Windows Update" = "download.windowsupdate.com" and add those definitions to the 'Transparent mode skiplist' on the 'Advanced' tab.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

0 Arthur.Bommele over 15 years ago

Added the DNS Group you mentioned but it made no difference.

010:10:15-23:15:10 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xb07cedb0" url="download.windowsupdate.com/.../windows6.1-kb2378111-x64_327157c0d8583986a93c42f3281e2abd9547cd2e.psf" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-23:15:10 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="289 ms" request="0xb07cedb0" url="download.windowsupdate.com/.../windows6.1-kb2378111-x64_b0de5bd82535a7c3f334716d9891d4875d895a04.cab" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-23:15:13 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="605380" time="303101 ms" request="0xa2824ef0" url="download.windowsupdate.com/.../windowsmedia11-kb2378111-x64-enu_9f33e4561dd2061fda865b6c2dc447cfed31c074.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-23:15:19 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="2287" time="0 ms" request="0xb080f6e0" url="download.windowsupdate.com/.../wsusredir.cab

2010:10:15-23:15:20 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa282c468" url="download.windowsupdate.com/.../windows6.1-kb2378111-x64-express_b769f08163a044451c358f77a7f10b727086f75e.cab" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-23:15:20 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="6312" time="1376 ms" request="0xb080f6e0" url="download.microsoft.com/.../wsusredir.cab

2010:10:15-23:15:31 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="657 ms" request="0xa282c468" url="download.windowsupdate.com/.../windows6.1-kb2378111-x86-express_3d9d1ecd9f94cbc5898940767c9cfeb4e7192db8.cab" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-23:16:35 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="86502" time="64510 ms" request="0xa282c468" url="download.windowsupdate.com/.../windows6.1-kb2378111-x86-express_3d9d1ecd9f94cbc5898940767c9cfeb4e7192db8.cab" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-23:16:40 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="227 ms" request="0xa282c468" url="download.windowsupdate.com/.../windows6.1-kb2378111-x86_3fd7c3442dacc65fb44e5cbc0c7a049f442441d4.cab" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-23:17:14 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="502" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="213210" time="123983 ms" request="0xb07cedb0" url="download.windowsupdate.com/.../windows6.1-kb2378111-x64_b0de5bd82535a7c3f334716d9891d4875d895a04.cab" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:15-23:17:32 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="2421" time="0 ms" request="0xa24e3350" url="download.windowsupdate.com/.../windows6.1-kb2207566-x86_019e20ed0a18702a668359068b61132e593a4f7a.psf" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

Also getting an increased number of disconnections for Remote Desktops now.
Looks like it's escalating.

Placed a support call. Awaiting assistance.

0 Arthur.Bommele over 15 years ago

Still failing to see the logic in this:

2010:10:17-02:39:15 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa265eff0" url="download.windowsupdate.com/.../windowsserver2003-kb2345886-x86-express-nld_20f7e3bd9c4615feeee829ba5f619eea6666b298.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:16 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa2453268" url="download.windowsupdate.com/.../ie8-windowsserver2003-kb2360131-x86-enu_8f4b5078a8a90b155e6784067d1558cd518beb20.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:16 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa256e8e0" url="download.windowsupdate.com/.../windowsserver2003-kb2345886-x86-nld_c2ecadfc58b5a8ca09584998c3ea84f257b6f0b6.psf" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:16 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa265ea18" url="download.windowsupdate.com/.../windowsserver2003-kb2345886-x86-nld_bd70a5503206ab71c03eb503517a8ce25e0182e4.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:16 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="394 ms" request="0xa2453268" url="download.windowsupdate.com/.../windowsserver2003-kb2345886-x86-enu_5381bfba428892978275f9b2747760f41d84d0d4.psf" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:16 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa265ec70" url="download.windowsupdate.com/.../ie8-windowsserver2003-kb2360131-x86-nld_2e6616f6bcc8121a9cd76a90951fa9d0b216376d.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:16 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="593 ms" request="0xa265eff0" url="download.windowsupdate.com/.../windowsxp-kb2345886-x86-express-nld_37872e59895db54bf010eccd6918cf7c3f4fcb41.cab" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:16 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="388 ms" request="0xa256e8e0" url="download.windowsupdate.com/.../windowsserver2003-kb2345886-x86-express-enu_52e1fa2e0e2f4ce58b93d4ff56d49d496f77b9a7.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:16 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="231 ms" request="0xa265ea18" url="download.windowsupdate.com/.../windowsserver2003-kb2345886-x86-enu_6bef04385cacb36eba80816590eac2ec0f364b16.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:17 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="321 ms" request="0xa265ea18" url="download.windowsupdate.com/.../windowsxp-kb2345886-x86-nld_a6db9e1da6224df3cc86bf1545fccd99ab3b94ba.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:30 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa265f818" url="download.windowsupdate.com/.../mpas-fe_95ce282db6265b1f65743a91d33118d512ee65e5.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:30 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa2642ba8" url="download.windowsupdate.com/.../mpas-fe_2fa08b5d67545c3a4e4575beb915b22faaedd2d4.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:30 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa2642f88" url="download.windowsupdate.com/.../mpas-fe_cc7940d21e4384bb2b6fb7d4b1937835f7db390f.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:30 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="284 ms" request="0xa2642ba8" url="download.windowsupdate.com/.../mpas-fe_bd_ecb7bc1506475dcfb93ebf31302e38b61f9af17c.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:30 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="401 ms" request="0xa265f818" url="download.windowsupdate.com/.../mpas-fe_c638d2152c77a9a6a518bf2476905bb46e24c0a6.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:40 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa26436a8" url="download.windowsupdate.com/.../mpas-d_b205b933e17e528deff9e6083854f2d5b05df1bc.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-02:39:40 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="219 ms" request="0xa26436a8" url="download.windowsupdate.com/.../mpas-d_ebc98a8509ab94f6ec6a4ee59a199371f6f97f9f.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

0 BAlfson over 15 years ago

Either your DNS Group Network definition has a typo or your HTTP/S Proxy is not in a "Transparent" mode at present.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

0 Arthur.Bommele over 15 years ago

Definition: DNS Group: Windows Update
download.windowsupdate.com [195.59.126.49 (119IPs in total)]
Used in these configurations: Web Security -> HTTP -> Advanced

Web Security: HTTP/S: Global
Operational mode: Transparant

Web Security: HTTP/S: Advanced
Transparant mode skiplist: Skip transparant mode hosts/nets: Windows Update
Allow HTTP Traffic for Listed Hosts/Nets is checked

WSUS is configured to use the Astaro as a Proxy Server. As is the Internet Explorer on that server.

2010:10:17-23:51:37 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="602 ms" request="0xa2605620" url="download.windowsupdate.com/.../ie8-windowsserver2003-kb2360131-x86-enu_8f4b5078a8a90b155e6784067d1558cd518beb20.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-23:51:37 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="523 ms" request="0xa2453268" url="download.windowsupdate.com/.../windowsserver2003-kb2345886-x86-nld_c2ecadfc58b5a8ca09584998c3ea84f257b6f0b6.psf" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-23:51:37 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa256e820" url="download.windowsupdate.com/.../windowsxp-kb2345886-x86-nld_a7db12cbdb50105ec56328476bf8f7743c325473.psf" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-23:51:37 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="262 ms" request="0xa265eff0" url="download.windowsupdate.com/.../windowsserver2003-kb2345886-x86-nld_bd70a5503206ab71c03eb503517a8ce25e0182e4.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-23:51:37 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="260 ms" request="0xa26026b0" url="download.windowsupdate.com/.../ie8-windowsserver2003-kb2360131-x86-nld_2e6616f6bcc8121a9cd76a90951fa9d0b216376d.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-23:51:37 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="194 ms" request="0xa265eff0" url="download.windowsupdate.com/.../windowsxp-kb2345886-x86-nld_a6db9e1da6224df3cc86bf1545fccd99ab3b94ba.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-23:51:51 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa2605280" url="download.windowsupdate.com/.../mpas-fe_95ce282db6265b1f65743a91d33118d512ee65e5.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-23:51:51 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa265f2d8" url="download.windowsupdate.com/.../mpas-fe_2fa08b5d67545c3a4e4575beb915b22faaedd2d4.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-23:51:51 ASG110 httpproxy[1345]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="HEAD" srcip="***.***.***.***" user="" statuscode="404" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction=" ()" size="0" time="0 ms" request="0xa265f678" url="download.windowsupdate.com/.../mpas-fe_cc7940d21e4384bb2b6fb7d4b1937835f7db390f.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:17-23:51:51 ASG110 httpproxy[1345]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="0" time="319 ms" request="0xa265f2d8" url="download.windowsupdate.com/.../mpas-fe_bd_ecb7bc1506475dcfb93ebf31302e38b61f9af17c.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

0 BAlfson over 15 years ago

And, in the PC(s) whose requests are being handled by the proxy, in 'Internet Options' 'Connections' 'LAN Settings', the proxy server settings are not activated?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Arthur.Bommele over 15 years ago

Correct. And those to are having increasing difficulty to download whatever.
In fact, the WSUS server has been operating without a proxy for months without issue. It's only recently (part of the troubleshooting efforts) that only the WSUS server has been configured for proxy use.
Cancel
Vote Up 0 Vote Down

Cancel

0 Arthur.Bommele over 15 years ago

Support had a look. Turns out that the Eth0 of the Astaro had a ton of collision errors. After switching the Internal Interface over to Eth2 download speeds have significantly increased. As has the number of allowed requests within the Content Filter.

Looks like it's going to be a RMA.

2010:10:19-14:36:05 ASG110 httpproxy[3868]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="1457528" time="47955 ms" request="0x8088298" url="download.windowsupdate.com/.../windowsxp-kb981957-x86-nld_180a3c208edf6a747f01df618c0e29ddf9c37eed.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""

2010:10:19-14:36:39 ASG110 httpproxy[3868]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="***.***.***.***" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="1450360" time="48753 ms" request="0x8a95e80" url="download.windowsupdate.com/.../windowsxp-kb981957-x86-enu_b6248d4143162917a3c11eccf72c61a8d972dfb1.exe" exceptions="av,auth,content,url,ssl,certcheck,certdate,mime,cache" error=""