Smoothwall SG2008 not displaying sites properly

[ssiruuk2]

Just noticed a problem with our Smoothwall, BBC and some other sites aren't being displayed properly (see link below for the BBC Sport page that looks messed up) - most seem fine though.

http://i98.photobucket.com/albums/l264/ssiruuk2/bbc.jpg

Herses what it should look like (going through ISA)

http://i98.photobucket.com/albums/l2...ruuk2/bbc2.jpg

Any idea why this might be the case?

Thanks

[Domino]

I'd say its blocking a secondary site that holds the css and images.

Look at the log of a user who's trying to view the page and see if anythings being blocked

[DMcCoy]

NTLM auth?

Try enabling persistent connections in the advanced proxy settings under guardian.

It's worse in safari, although that (won't even do SSL, but that seems to be a safari bug as it happens with ISA too).

[tom_newton]

That's almost certainly what is happening - good spot guys.

LMK what the exact URL is (or if you can ping me a bit of exported log).. i'll see if I can reduce any overblocking on that css.

[tom_newton]

OK... it seems edugeek is getting better at guardian tech support than me ;-P

I will have a browse around BBC see if I can make it happen, as we are NTLM here too.

[DMcCoy]

OK... it seems edugeek is getting better at guardian tech support than me ;-P

I will have a browse around BBC see if I can make it happen, as we are NTLM here too.

Without the persistent connections, with a forced upstream proxy safari is unusable with ntlm :/ Get lots of missing images and CSS, despite using unfiltered for the users.

Without ntlm all is fine. I would use ident but I can't actually get any to work on XP SP3 atm they all return "system" as the current user

[HodgeHi]

I also have this problem. It is only with safari on os x mainly. I just never got around to querying it. Mine is on all sites that I visit.

[tom_newton]

I'll ask the developers to have a look and see if they can work out why safari might be getting bent out of shape.

[ssiruuk2]

Thanks for all the replies - Yes we use NTLM auth (terminal services compat) .

I tried enabling persistant connections but that hasn't made any difference unfortunately. Will have a look in the logs now and see what that turns up.

Thanks again - sorry forgot to mention we only use IE here.

[ssiruuk2]

Heres a sample of the log, I'm not sure what to be looking for but doesn't seem to be blocking anything - there is one warning and "modified" though:

9:29:34 testuser
BBC - Homepage 0 clean →Redirected (302)
9:29:34 testuser
BBC SPORT 0 →Redirected (302)
9:29:35 testuser
BBC SPORT 0 Warning OK (200)
modified
9:29:35 testuser
http://stats.bbc.co.uk/o.gif?~RS~s~RS~Sport~RS~t~RS~Hig 0 OK (200)
9:29:35 testuser
http://news.bbc.co.uk/sol/ukfs_sport/hi/front_page/tick 0 OK (200)
9:29:35 testuser
http://newsimg.bbc.co.uk/media/images/44964000/jpg/_449 0 OK (200)
9:29:35 testuser
http://newsimg.bbc.co.uk/media/images/44963000/gif/_449 0 OK (200)
9:29:35 testuser
http://newsimg.bbc.co.uk/media/images/44964000/jpg/_449 0 OK (200)
9:29:35 testuser
http://newsimg.bbc.co.uk/media/images/44964000/jpg/_449 0 OK (200)
9:29:35 testuser
http://newsimg.bbc.co.uk/media/images/44964000/jpg/_449 0 OK (200)
9:29:35 testuser
http://newsimg.bbc.co.uk/media/images/44724000/jpg/_447 0 →Not Modified (304)
9:29:35 testuser
http://newsimg.bbc.co.uk/media/images/44932000/jpg/_449 0 →Not Modified (304)
9:29:35 testuser
http://newsimg.bbc.co.uk/media/images/44535000/jpg/_445 0 →Not Modified (304)
9:29:35 testuser
http://newsimg.bbc.co.uk/media/images/44964000/jpg/_449 0 OK (200)
9:29:36 testuser
http://newsimg.bbc.co.uk/media/images/44964000/jpg/_449 0 OK (200)
9:29:36 testuser
http://newsimg.bbc.co.uk/media/images/44962000/jpg/_449 0 →Not Modified (304)
9:29:36 testuser
http://newsimg.bbc.co.uk/media/images/44964000/jpg/_449 0 OK (200)
9:29:36 testuser
http://newsimg.bbc.co.uk/media/images/44964000/jpg/_449 0 OK (200)

The front page of BBC looks fine, it seems to be if you click on any link after that.

such as BBC SPORT

Thanks

[tom_newton]

Did you disable the "ignore filter"? I don't see a request for the CSS :-/

"modified" refers to the fact that this page changed since the last caching.

[tom_newton]

Closest thing I have to safari is Konqueror, the KDE browser. They're built of the same stuff, but K works fine here will hunt a mac user!

[ssiruuk2]

Hi Tom

Heres some more of the log (that before was taken from the realtime one)

2008.8.28 14:42:56 testuser 172.16.0.80 BBC SPORT | Football *CONTENTMOD* *SCANNED* GET 66933 -280 News 2 200 text/html Default Users "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)
"




2008.8.28 14:42:58 testuser 172.16.0.80 http://news.bbc.co.uk/css/screen/sol...euro08.css?v58 *SCANNED* GET 17887 -15 News 2 200 text/css Default Users "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)
"

There are a few places such as above in the log where its scoring negative points is this whats being blocked? That last bit above was the only mention of CSS in the whole of the export (didn't want to post all that of it as it was massive!)

Just to update this - I added newsimg.bbc.co.uk and news.bbc.co.uk to the "custom allowed content list", did a soft restart on the proxy and bbc now looks fine - any ideas why smoothwall was blocking it? I know I have seen a few other sites failing to load the css / images but can't remember what they are now.

[tom_newton]

It looks like content modification... "Contentmod" as opposed to "modified". Wonder which rules you have on in terms of "content security" filters.

I'm running just "recommended security rules" here, and BBC isnt getting mod'd...

[forcryingoutloud]

I'm playing with both methods, but it looks IDENT is going to be the one I go for. I'm runing SP3 and IDENT using smoothwalls version of the old Dans Guardian IDT