This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Google Music Beta Upload Issue

Background:
ASG 8.103
4 rules on the firewall

[LIST=1]

Any - FTP - Any (Block)
Any - HTTP - Any (Block)
Internal Network - Any - Internet IPV4 (Allow)
Wireless Guest - Email Messaging - Internet IPV4 (Allow)

[/LIST]
Intrusion Protection on
IM/P2P Control on (for the Wireless Guest Network)
HTTP/S Proxy on in transparent mode
FTP Proxy on
Antivirus for HTTP/S, FTP on
AntiSpyware on

Problem:
Ok, so I'm trying to use the Google Music uploader and it won't upload. I turn HTTP/S Proxy off and it uploads. URL Filtering is on for the HTTP/S Proxy. The category which is blocked is the "Suspicious" category. No changes have been made to the categories themselves. I tried putting in an exception with the follow RegEx: ^https?://[A-Za-z0-9.-]*google.com which is probably wrong, but I don't know RegEx so it was complete guess work based on the other exceptions in the list. I tried looking at the live log for HTTP/S Proxy while trying to upload and I get no blocks in the log.

Anyone have any ideas?

I'd be willing to bet that the uploader sends information to a particular IP instead of a domain name, but without more technical information posted from google or a log entry that I can poke through I can't find out what that might be. Aside from that does anyone have any ideas where else I could look to find that information or know if I just blew the RegEx statement?

Thanks for any help.

-Bob Adams

This thread was automatically locked due to age.

Parents

0 BAlfson over 14 years ago

Hey, Bob,

Your REGEX looks like it should do the trick. Do you have everything checked in the exception you created for it? If so, then this may be one of those servers that just doesn't like proxies.

You said there were no blocks, but could you show us the lines from the 'Content Filter (HTTP/S)' log related to one of these accesses?

Cheers - Bob
PS And, like Scott said, be sure to look in the IPS log, too. And in the "IM/P2P Classifier' log.

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 14 years ago

Hey, Bob,

Your REGEX looks like it should do the trick. Do you have everything checked in the exception you created for it? If so, then this may be one of those servers that just doesn't like proxies.

You said there were no blocks, but could you show us the lines from the 'Content Filter (HTTP/S)' log related to one of these accesses?

Cheers - Bob
PS And, like Scott said, be sure to look in the IPS log, too. And in the "IM/P2P Classifier' log.

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Redactor007 over 14 years ago in reply to BAlfson

Ok, here's what I've got.

The relevant lines from HTTP/S Proxy log:

[FONT=monospace]2011:06:30-17:22:05  bob httpproxy[11818]: id="0001" severity="info" sys="SecureWeb"  sub="http" name="http access" action="pass" method="GET"  srcip="192.168.12.208" dstip="72.14.204.132" user="" statuscode="304"  cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)"  filteraction="REF_DefaultHTTPCFFAction (Default content filter action)"  size="0" time="38 ms" request="0x9ce5cf90"  url="lh4.googleusercontent.com/.../FONT]
[FONT=monospace]2011:06:30-17:22:32  bob httpproxy[11818]: id="0001" severity="info" sys="SecureWeb"  sub="http" name="http access" action="pass" method="GET"  srcip="192.168.12.208" dstip="74.125.93.116" user="" statuscode="200"  cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)"  filteraction="REF_DefaultHTTPCFFAction (Default content filter action)"  size="11566602" time="27006 ms" request="0x9ce222f8"  url="t.doc-0-0-sj.sj.googleusercontent.com/stream

This is the list of blocked file extensions:

ade,adp,app,bas,bat,chm,cmd,com,cpl,crt,csh,fxp,hlp,hta,inf,ins,isp,jse,ksh,lnk,mdb,mde,mdt,mdw,msc,msi,msp,mst,ops,pcd,pif,prg,reg,scr,sct,shb,shs,url,vb,vbe,vbs,wsc,wsf,wsh

There are no entries in the IPS log.  Neither are there any entries in IM/P2P Classifier log

I did see that it seems to be using googleusercontent.com so I changed the exception filter (see attached image) to that with no change in behavior.

I'm pretty sure the problem is in the HTTP/S Proxy because when I turn it off I'm able to upload just fine.  I just don't know how to create an exception or filter that will make it work.

Thanks for the ideas guys.  I'll poke around some more and see if I can find something that works.  Of course if you have any other ideas I would love to hear them.

-Bob Adams