topic ping is not allowed in this in Web Security

WSA problem accessing two webs

Jesus Cano Villar — Fri, 21 Apr 2017 09:15:02 GMT

hi,

We are having problem accessing to two of our webs. Doing a packet capture in the client machine we see the error 504, and doing pcap in the WSA we see the error 404. If we bypass the proxy both webs are working. We dont see any drops in FWs.

Where could it be the cause for this problem???

Product: Cisco S170 Web Security Appliance
Model: S170
Version: 10.1.0-204

Please see the below

syeda3 — Fri, 21 Apr 2017 12:31:37 GMT

Please see the below troubleshooting urls for WSA for gateway timeout.

http://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/118079-troubleshoot-wsa-00.html

http://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/118217-troubleshoot-wsa-00.html

I saw all these notes and i

Jesus Cano Villar — Fri, 21 Apr 2017 12:55:31 GMT

I saw all these notes and i opened a TAC case. TAC closed ticket because in the pcaps the error was 504 so the problem is in another intermmediate device. But after this, we bypass the WSA and its working fine. Three-way handshake is done properly between WSA and server, but when WSA sends GET we dont see any respond. So its seems like its not a connectivity problem.

Where could it be the cause for this problem???

Typically when

Tim Glen — Sat, 22 Apr 2017 05:08:59 GMT

Typically when troubleshooting an issue like this a network diagram that shows MAC & IP addresses is needed in order to understand what is being seen in the PCAP.

trying to ping the web site, if your WSA is replying to the PING request the Layer 4 Traffic Monitor may be blocking the website, not the URL filter.

ping is not allowed in this

Jesus Cano Villar — Mon, 24 Apr 2017 07:11:27 GMT

ping is not allowed in this server but running a GET from WSA i get response. I checked Layer 4 Traffic Monitor and its disabled.

The URL Category or Web

Sriram Subramanian — Mon, 24 Apr 2017 14:45:19 GMT

The URL Category or Web Reputation Score in Access Policies / HTTPS Descryption Policy could be flagging the website you are accessing to be blocked. You could try creating a whitelist in the URL Category and applying it to the access policy to allow or pass through in HTTPS Descryption Policy.

We dont have any Decrypt

Jesus Cano Villar — Tue, 25 Apr 2017 08:14:02 GMT

We dont have any Decrypt policy. We tried that with no success 😞