UTM running Full Transparent, web filtering not working

I'm having the same issue and the same entries in the Web filtering log.

Here is the Global config...

Here is the filter config...

There are dozens of domains in the blacklist, but none are actually being blocked. When I run the domain through the Policy Helpdesk is says it should be blocked but if I browse to the site on a PC I get through just fine.

Another strange symptom is that when I try to view any of the Web Protection reports there is nothing in the reports. They all say "No data" or "Empty result".

I have another Sophos appliance at my other location with the exact same settings and it is working fine.

Hi Scott,

Try to add RegEx in place of domain. RegEx for Netflix will be:

 Also, can you post http.log while trying to access netflix.com after making the changes?

Thanks

logfiles_20160914083148.zip

Reg expression added.

httpproxy has been restarted.

Log file is attached.

Still not working. The issue is more than just Netflix not being blocked....None of the more than a dozen websites in the blacklist are being blocked. I think these are symptoms of a larger problem.

Hi, Scott, and welcome to the UTM Community!

There's nothing being blocked because the traffic is bypassing Web Filtering.  Please show a picture of the 'Global' tab.  You didn't say so, but I assume that the UTM is running in bridged mode between your internal network and your edge router - correct?

Cheers - Bob

Same settings (except the LAN definition) are working fine on the Sophos appliance (same model) at our other location.

Is the network topology the same in both locations?  You didn't confirm my guess.

Please insert a picture of the 'Interfaces' tab.

Cheers - Bob

Topology is the same at both locations.

What happens if you disable "Management Interface 2" or assign it to a subnet that doesn't conflict with that on br0?  See #3.1 in Rulz.

Cheers - Bob

I disabled management interface 2. No change. Restarted the device. No change.

I disabled management interface 2. No change. Restarted the device. No change.

Until you change the subnet on eth5 so that it doesn't overlap the one on eth0, it will be difficult to draw any conclusions.  If you disabled MI2 ad immediately had a failed test, it may have been because the configuration daemon hadn't yet completed rewriting and activating the new configuration.

Cheers - Bob