SOPHOS UTM 9 Error Code

[chrispounds]

Hi Guys / Gals,

Not sure if anyone has experience with a UTM, I'm having troubles with accessing a certain website through the proxy, using UTM 9, with 9.501.5 firmware.

I get the error code 504 (connection timed out), i've attached the logfile code so you can see.

/var/log/http.log:2017:06:26-08:52:18 sophos httpproxy[10795]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="" dstip="91.103.217.116" user="dummystaff" group="Staff Mail- all active staff accounts" ad_domain="" statuscode="504" cached="0" profile="REF_DefaultHTTPProfile (Default Web Filter Profile)" filteraction="REF_HttCffStaffDefauPolic (Staff Default policy)" size="85226" request="0xd184ca00" url="http://bagzone.co.uk/" referer="" error="Connection to server timed out" authtime="91" dnstime="240" cattime="18919" avscantime="0" fullreqtime="60250119" device="0" auth="2" ua="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36" exceptions="auth,url,ssl,certcheck,certdate,mime"

Steps so far, include the usual website exception, which didn't work, AV skipping, no luck. Then i tried adding it to transparent mode skiplist, both source and destination as a DNS host, with URL applied to the eth that the proxy is connected to.

 

Is there anything else i can try? Still newish to this UTM, so apologies if i miss anything glaringly obvious.

 

Just to mention, tried without proxy = fine. Other browsers, i get the same result, a timeout error from UTM displayed on screen.

Edited June 26, 2017 by chrispounds

[colly72]

You can try increasing the UTM timeout, to see if that helps:

 

https://networkguy.de/?p=780

[chrispounds]

Hmm, thank you for the suggestion, the timeout is happening before 60 seconds have elapsed, which is the default setting, so i don't think that's the cause, but i am willing to give it a go!

[colly72]

9.501-5 is still pretty buggy by all accounts, which may or may not be the cause of your issue. If possible I'd try and rollback to 9.413-4 to see if the problem still exists. Appreciate it's not always easy to rollback in a live environment though.......

[chrispounds]

Hi Colly,

 

Yeah i did see that there are a number of little issues, although i'm never sure they come out with a stable version! So far, it's only 1 website in question, so i think in this case they will have to find an alternative source of bags for the college shop! Not worth the hassle and weekend work of a rollback! Thank you for the suggestion though, much appreciated

[Jaan]

We use Sophos here. Looking at that rule, on our system it would block internet access for the "dummystaff" user as you have exceptions="auth". our rules would block all access to the internet if the utm is unable to authorise that user.

 

try the below and see if that works.

 

EDIT: sorry just re-read that... you already have url skipping enabled, sorry

 

 

Edited June 26, 2017 by Jaan

[chrispounds]

Hi Jahilton2002,

 

I have tried applying a Skip all site checks rule to the domain, but i will make a specific one, in case the rule i made previously isn't being applied, i will report back.

Edited June 26, 2017 by chrispounds

[chrispounds]

So, no luck with the exception, i even made it a REGEX match, to rule out any discrepancies with the URL. I think i'm going to have to revisit this one later, until someone else comes along with the same issue, it seems to be less than 1% of sites that i encounter this with.