topic Re: Cannot download from HTTP sites via Internet Explorer in Network Security

Cannot download from HTTP sites via Internet Explorer

Rex Biesty — Mon, 11 Mar 2019 10:01:59 GMT

Hello, I have an issue with a newly configured ASA firewall (running v7).

From a client machine (using the ASA as the default gateway) I can download files from sites that use FTP but not from sites that use http. However, if I use Firefox (rather than Internet Explorer) I can download from FTP and HTTP without issue. General browsing works fine in all scenarios.

If I enter our proxy server details into Internet Explorer - downloading is fine also. I want to move away from this config though as the ISA proxy server is in the process of being decomissioned.

Please help

Re: Cannot download from HTTP sites via Internet Explorer

zulqurnain — Sun, 22 Apr 2007 09:54:11 GMT

hello,

if you can post your config it will help solving your issue quickly.

Re: Cannot download from HTTP sites via Internet Explorer

Rex Biesty — Mon, 23 Apr 2007 09:43:31 GMT

As requested - thanks

Re: Cannot download from HTTP sites via Internet Explorer

zubairjalal — Mon, 23 Apr 2007 10:06:07 GMT

have you tried putting the inspect on http traffic

Re: Cannot download from HTTP sites via Internet Explorer

Rex Biesty — Mon, 23 Apr 2007 11:10:50 GMT

Thanks for the reply. I've added the 'inspect http' command to the global policy but alas it's made no difference.

Re: Cannot download from HTTP sites via Internet Explorer

musa19ie — Tue, 24 Apr 2007 07:58:10 GMT

it seems to me that you are facing a problem with the tcp MSS, I think that your asa is dropping packets that exceed the mss advertized on the handshake phase, you can add the follwoing code to solve it:

access-list http-list permit tcp any host server_ip eq 80

class-map http

match access-list http-list

tcp-map tmap

exceed-mss allow

policy-map global_policy

class http

set connection advanced-options tmap

Re: Cannot download from HTTP sites via Internet Explorer

Rex Biesty — Tue, 24 Apr 2007 08:28:34 GMT

I'm afraid that makes no difference either (just hangs on the 'file download' box)

Re: Cannot download from HTTP sites via Internet Explorer

Rex Biesty — Mon, 30 Apr 2007 07:35:12 GMT

Any more takers? I can't turn off ISA until I have a resolution to this. Thanks.

Re: Cannot download from HTTP sites via Internet Explorer

Rex Biesty — Mon, 30 Apr 2007 13:33:08 GMT

More info - it actually seems to be related to certain sites rather than protocols i.e. I can download from HP and Dell websites but not Microsoft (though automatic updates is working)

Re: Cannot download from HTTP sites via Internet Explorer

Rex Biesty — Wed, 02 May 2007 06:41:13 GMT

Even more info. We use websense to filter URLs and turning off the filtering enables downloading without issue. I'll need to do a bit more digging into why this is.

Re: Cannot download from HTTP sites via Internet Explorer

gglynn — Wed, 02 May 2007 19:18:08 GMT

We ran into this, too; it appears to be a bug with the Websense integration in earlier 7.x releases. Upgrading from 7.1(2) to 7.2(2) fixed it for us.