Hello,
maybe someone can help me with this issue. From time to time it happens that user requests that should hit the user access policy are instead matching the default policy and are dropped. If the user refreshed the page, the correct policy is hit.
When this happens the user is correctly identified and all other matching conditions match. Its a S395 running 14.5
I have attached a screenshot where the blocked request can be seen because it matches the default-policy. Next request hitting the correct policy. Same user, same source IP.
I had this happening in the past when users went via google sponsored links that the first initial request hit the default policy dispite all conditions matched for the user access policy. Now I have reports it is also happening when the users go the webpage directly and I am unable to reproduce it because it happens so randomly and not ver often. (1000 requests are fine matching the user policy, then suddenly one request hits default policy and user gets block page)
Any help is appreciated.
I should add as a note this is just an example and same issue i see with domains that are not part of any custom URL list. Even if its a content category, like in this case "Business and Industry" and not inside a custom list, it should match a access policy above the default policy because all conditions do match but for some reason sometimes they do not.
In this example, user is successfully authenticated. That happens in the global Identification profile.
It should match this policy since user is authenticated in Global Idenfitication Profile and "Computers and Internet" is allowed in this Access Policy.
Instead of matching this policy it matches Default policy. Hitting refresh in the user browser it suddently matches to the correct Access Policy.
Thanks a lot to both of you,
There is only one Identification Profile the user can match and thats the default one. Using explicit proxy.
All other profiles above are noAuth Rules with IP + URL matching conditions. The user hits the correct "Global Group" for Authentication, otherwise user would not get authenticated because all other profiles are no Auth.
Auth Profile looks like this:
@amojarra I assume the first bug refers to having multiple Identification Profiles using an Auth Realm and using different Surrogates there. In my case I only use the global Group. All other profiles are no auth exceptions.
Also second bug seems something else since in my case if the user trys to access the exact same URL again it will work on the second try and hitting correct policy. Also does not matter if its custom URL or a content category.
My issue is that for example user opens webpage www.xyz.com it works in 99% of the time and matches the User policy. Then suddently one user receives block page because his request hit default policy instead of user. If he clicks the same link again it will work.
Here is another example. Same user, same source IP accessing the exact same URL. One request hits the correct AP_Proxy_Chaining Policy, the other one hits Default Access Policy.
