INTERNAL_ERROR when trying to access website

[KVWL IT-Administration]

Hi,

we recently ran into a problem accessing the page www.infas-geodaten.de (or the corresponding IP) through our IronPort S160.

Even a policy trace ends up with a failure.

Any help on how to narrow down this problem or how to solve it is welcome.

Kind regards,

Thomas

Diese Seite kann nicht angezeigt werden.

---

Bei der Verarbeitung der Anfrage zur Seite ( http://www.infas-geodaten.de/ ) ist ein interner Systemfehler aufgetreten.

Bitte wiederholen Sie diese Anfrage.

Wenn der Fehler weiterbesteht, kontaktieren Sie bitte Ihren ServiceDesk und geben den unten genannten Code an.

---

Meldungs-Codes:

(1, INTERNAL_ERROR, http://www.infas-geodaten.de/)

Diese Seite kann nicht angezeigt werden.

---

Bei der Verarbeitung der Anfrage zur Seite ( http://195.227.221.196/ ) ist ein interner Systemfehler aufgetreten.

Bitte wiederholen Sie diese Anfrage.

Wenn der Fehler weiterbesteht, kontaktieren Sie bitte Ihren ServiceDesk (Tel.: 9800) ( servicedesk@kvwl.de ) und geben den unten genannten Code an.

---

Meldungs-Codes:

(1, INTERNAL_ERROR, http://195.227.221.196/)

[sfiebran]

Hi Thomas,

you are sure this error was generated on your S160? Of these request, could you lookup this request in the aclogs? The according log line should englighten more what might have caused it.

Thanks,

Stephan

[KVWL IT-Administration]

Hi Stephan,

the message is generated by our S160 indeed.

I looked up the request in the accesslog:

1339999212.554 150113 172.22.20.13 NONE/502 1855 GET http://www.infas-geodaten.de/ "DOM\user@DS.DOM.KVWL.DE" DIRECT/www.infas-geodaten.de - OTHER-NONE-KVWL_User-NONE-NONE-NONE-DefaultGroup -

Any hint in there?

Thanks a lot,

Thomas

[sfiebran · Accepted solution]

Hi Thomas,

Thanks for the accesslog details. When we now look at the timing (150113ms, which is ~2x 75sec, the WSA TCP timeout on SYN connect) together with 502 (gateway timeout) would mean that the WSA was not able to establish a TCP session to the destination server for some reason.

You could mimic a TCP connect test on the CLI of the WSA to the host via the telnet command:

> telnet www.infas-geodaten.de 80

to see if something on the routing/firewall is missing here.

Hope I could help you a bit further.

-Stephan

[KVWL IT-Administration]

Hi Stephan,

shame on me I didn't telnet the host directly from the S160 right away... As you supposed the TCP SYN times out.

Routing and firewall are fine over here. I double checked that and also tried to telnet www.infas-geodaten.de from our most outer system without success.

So no problem regarding the S160.

Contacted the operater. Seems as if their routing is buggy or they are blocking our ip-range as none of the services residing in their ip-range is responding.

Regards

Thomas