This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Https often fails to bring up page

HI there 9.2 utm hardware. Very often https: pages fail to display at all. Chrome display unable to connect. Web protection setting is to intercept https domains only not full decrypt of course.
No specific port 443 firewall rules. Transparent intercept.
Not sure where to look

This thread was automatically locked due to age.

0 ManuelKarl over 11 years ago

Hi jlabza,

can you show some proxy-logs to see what is happening with these requests?
Checked IPS/AppControl (if active)?

Manuel
Cancel
Vote Up 0 Vote Down

Cancel
0 jlabza over 11 years ago

just spent 10 minutes trying to get to this page https://www.astaro.org [:)]
chromse says "establishing secure connection" then just sites there. same for google.

turned off App control - nothing was logged anyway apart from SSL and allows..
nothing looged in appropriate time period for IPS.

web filter just like this
2014:05:20-21:42:14 jlhome httpproxy[28011]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="CONNECT" srcip="10.100.10.102" dstip="85.115.22.9" user="" statuscode="200" cached="0" profile="REF_HttProContaWippaNetwo (PC Profile)" filteraction="REF_HttCffPcFilteActio (PC Filter Action for blackbox)" size="461" request="0x251ff760" url="www.astaro.org" exceptions="" error="" authtime="0" dnstime="16" cattime="108934" avscantime="0" fullreqtime="61217501" device="0" auth="0" country="Germany" category="165" reputation="neutral" categoryname="Technical/Business Forums"
Cancel
Vote Up 0 Vote Down

Cancel
0 jlabza over 11 years ago

or this to another HTTPS site - worked the second time i hit enter

dstip="206.191.171.100" user="" statuscode="200" cached="0" profile="REF_HttProContaWippaNetwo (PC Profile)" filteraction="REF_HttCffPcFilteActio (PC Filter Action for blackbox)" size="371" request="0x2556c000" url="login.watchguard.com" exceptions="" error="" authtime="0" dnstime="1110" cattime="63050" avscantime="0" fullreqtime="30022069" device="0" auth="0" country="United States" category="175" reputation="trusted" categoryname="Software/Hardware"
Cancel
Vote Up 0 Vote Down

Cancel
0 M.Rottler over 11 years ago

I have the same issue with our UTM220!

Since I disabled IPS, it's working again... I think there's too much load on our UTM...!
Cancel
Vote Up 0 Vote Down

Cancel
0 jlabza over 11 years ago

yes it must be tough managing a one user network [:)]. May have been that i hadturned that off to see how it goes.
Cancel
Vote Up 0 Vote Down

Cancel
0 tjhia over 11 years ago in reply to jlabza

Hi Guys, i had the very same problem too with my UTM 220!

did switching IPS fixed the problem? i just tried to switch it off and see how it goes, but if it does work, there has to be a specific rule in UTM that Google Chrome does not like.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 11 years ago

I run ips full on and this is not an issue. These forums get to be unstable at times..have you tried other https sites? the ips cannot inspect inside https packets. Do you have https interception enabled in the http proxy?
Cancel
Vote Up 0 Vote Down

Cancel
0 tjhia over 11 years ago in reply to William Warren

I tried switch off the IPS and that does not solve our problem.

the latest testing i am on now, is to ensure that the clients (Chrome) properly go through UTM for http/https requests. We didnt use proxy before as it always kill the UTM220 due to high RAM consumption when proxy is on, so i just setup a pac proxy and force the test clients to use the proxy for web requests. If my theory is correct, somewhere between the UTM and client got "confused" with the packets and drop the connection.

will post the update if it works. this problem has been driving me mad for a couple of months now.

EDIT: William, yes it does it to random https sites, pretty much everything with "https" will have the same problem of stuck at "Establishing Secure Connection" before then timed out. standard http site have no issue.
Cancel
Vote Up 0 Vote Down

Cancel
0 teched_01 over 11 years ago

Are the problematic clients running Sophos Endpoint? Client OSes?

Are all/multiple clients experiencing the same problem at the same time?

Does restarting the proxy (/var/mdw/scripts/httpproxy restart) make https sites start loading (once the proxy actually finishes restarting)?
Cancel
Vote Up 0 Vote Down

Cancel
0 tjhia over 11 years ago in reply to teched_01

Yes, our environment are all running Sophos End Point, but there is no web scan enabled. in UTM, we also disable full HTTPS scan, just do URL header only.

OS seems to be problem with windows 7 clients and also server 2008. We used to be fine with Direct connection setup on client's browser, and this problem started to happen approximately 2 months ago after heartbleed issues (mid may?). we were still running 9.1 and we are now running 9.2 but the problem still persists.

my own laptop is running Windows 8 Professional and i dont see the problem that they are seeing and i am part of the same network, subnet and switch.

preliminary tests has been quite promising with forcing clients to use proxy rather than direct connection. Will keep posting on this matter.
Cancel
Vote Up 0 Vote Down

Cancel