Sophos UTM 9.103-5
Web Protection -> Web Filtering generates permanent traffic, always using nearly 100% of the WAN line.
If you set the "Filtering Status" to disabled, traffic stopps immediately.
Flow COntrol shows this:
1 ewe-ol-GGC-Node1-host5-158.cache.google.com tcp/443 65 KB/s 1 MB
2 ewe-ol-GGC-Node1-142.cache.google.com tcp/80 56 KB/s 2 MB
3 ewe-ol-GGC-Node1-host8-167.cache.google.com tcp/80 0 B/s 20 MB
4 ewe-ol-GGC-Node2-241.cache.google.com tcp/443 0 B/s 354 KB
5 ewe-ol-GGC-Node2-241.cache.google.com tcp/80 0 B/s 29 KB
Even if you enable the webproxy with only one network, for example Cisco VPN Pool (which is not configuried and without user), traffic doesnt stopp!
If you block this traffic in the Flow Controll Monitor (Sophos UTM defined it as "Google"), the traffic doesnt stopp.
When you lock in the web proxy log, the traffic isnt shown there, only th normal web traffic of the users.
Only application control is countig this traffic, but not able to stop it with a application control rule.
Sophos UTM show beetween 400-800 Concurrent connections, even when nobody is surfing,
If you disable the web proxy, only 30-50 connections are displayed, what i think is normal.
Everything else is normal and works fine.
Does anyone have an idea what is going on?
Thx for help!
This thread was automatically locked due to age.
