Vivomiles problem through the smoothwall

[timbo343]

Ive managed to get the exported certificate to say firewall.shs.com - that's the first problem sorted.

 

Second problem..

We use a site called vivomiles.com in school, its a reward system. I have to put the domain vivomiles.com into either the SSL/CRL or the Auth Bypass to get it to show a basic version which doesnt work.

 

If i leave it out of any custom category, looking at the real time logs i get "DENIED: TLS handshake with client failed" which means the site doesnt load. If i add the site to custom allowed into the URL patterns, i get the same error.

 

If i add it to Auth Bypass i get a basic site but cannot do anything with it. After looking at the logs i see ssl.google-analytics.com, themes.googleusercontent.com and maps.gstatic.com and got the same error with the handshake so ive had to add these sites to auth bypass.

 

Anyone from smoothwall or anyone else kindly explain why this is happening?

 

Thanks.

Edited September 8, 2013 by timbo343

[tom_newton]

Auth bypass is probably not the place - it looks like it is managing auth but that the site isn't playing nicely with SSL. While i look into it, try making another ctegory with just this site in it, and applying a whitelist rule. That's the most powerful "let this stuff through" rule there is

[Earthling]

I think I might have a similar problem.

 

I'm trying to access a secure portal on hertsdirect.org. I cannot get to it at all using the Smoothwall as the proxy. I can get to practically every other site on the internet, but not this one.

 

I've taken some Wireshark captures using the Smoothwall and one of the Herts Grid upstream proxies, and the traffic is radically different. The captures using the upstream proxy show the TLS client/server 'Hello's, but in the captures from the Smoothwall, these packets are just not there. I assume they're either not being sent/rec'd or are being corrupted somehow.

 

I have a call logged on the Help Desk for this, #00047573, and I have a down-and-dirty workaround for the only user to access this portal, so it's not mega-urgent, but the problem is nagging at the back of my mind and I'd like to understand it and solve it, if possible.

 

The other problem I'd like to understand is, 'Why is there always one user on every network who wants to do something different to all the others?', but I guess that's for a different thread and a different time