HTTPS inspection issue

Hello All,
I have seeing error 12227: the name on the SSL server certificate supplied by a destination server does not match the name of the host requested.
I have already put in the entry in the https destination exception with no validation option enabled for the SAN Values that i see in the certificate. I have also added the entry in the host file for the solution, as i suspect the issue can be with the reverse
DNS lookup.
I have also installed the latest rollup but still i see same error.
The entries added in the exception with no validation option enabled are:-
abc.com
www.abc.com
*.abc.com
Any body have any idea as to why this is happening?

Hi,
Please try to analyze WP log and ISA trace to see whether the site is in the exclusion list.
Best Regards,
Joyce
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Similar Messages

CSW: Filtered Google Images still appearing with HTTPS Inspect configured

Hi,
I'm currently testing https Inspect to close a hole in the Google Images search.
I was under the impression that https inspect would not display any images that are in the a blocked category.
I have a CSW created certificate installed on the PC I'm testing on which I see as being accepted. If I delete the cert from the PC, then I can't get to google (via https) as the cert is not accepted.
However, with the cert running on the PC, images are not being filtered within a Google search. It's not practical for us to change to a "safesearch on" policy and was under the impression that https inspect would indeed filter the images, but it's not. I've tested on some images that they are blocked as if I click the "visit site" or "view image" links, then I get the blocked page.
Any help is very appreciated.
Thanks
Craig

Thanks for the answer, but that's crazy, it didn't used to be like that before Google forced https on everyone.
I can't see how safe search can be enforced? I know it can be done on at DNS, but that doesn't help our field users who connect to their own/public wifi. Even when they are VPN'd, we use split tunnelling so that won't work either.
Seems a real limitation of CWS that you cannot simply manipulate URLs or make custom suffix's? Or can you?
Our contract is up later this year and with all the issues we've had lately combined with it not being a very powerful solution, I suspect we'll be looking elsewhere.

HTTP Inspection Cisco PIX 525

I need to filter inbound HTTP requests <outside> to <dmz> headed to www.XYZ.com/XXX/admin/XXX.jsp.
My regex is:    regex HACKBLOCK "*/admin/.*\.jsp*"
My class-maps are:
class-map type regex match-any HACKBLOCK_METHOD
match regex GET
class-map XXXXTWBLOCK
match access-list HACKBLOCK_HOSTS
class-map type regex match-any HACKBLOCK_URL
match regex HACKBLOCK
class-map type inspect http match-all HACKBLOCK_FILTER
match request uri regex class HACKBLOCK_URL
class-map inspection_default
match default-inspection-traffic
My policy-maps are:
policy-map type inspect http HACKBLOCK_HTTP
parameters
class HACKBLOCK_FILTER
log
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect netbios
inspect rsh
inspect rtsp
inspect sip
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect xdmcp
inspect dns
inspect h323 ras
class XXXXTWBLOCK
inspect http HACKBLOCK_HTTP
policy-map OUTSIDE
class XXXXTWBLOCK
inspect http HACKBLOCK_HTTP
class class-default
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 1200
As you can see, I added the inspection rule to a seperate class name ENPROTWBLOCK. This matches traffic based on destination of our class C. I see that I am matching traffic in the ACL, but no matches on the HTTP inspection rule:
#sh service-pol inspec http
Global policy:
Service-policy: global_policy
    Class-map: inspection_default
    Class-map: XXXXTWBLOCK
      Inspect: http HACKBLOCK_HTTP, packet 745097, drop 0, reset-drop 0
        protocol violations
          packet 34206
        class HACKBLOCK_FILTER
          log, packet 0
enp-amer-clt-pix525-a#
I am generating bogus traffic to http://www.<ourdomain>.com/admin/test.jsp
Any idea whats going on here and why I am not macthing the HTTP uri's ????
Thanks,
Matthias CCIE# 28445

I get hits on the ACL. The issue is that the HTTP inspection does not seem to function. Just for my own understanding, the global policy will match inbound traffic arriving on the outside interface right ?
access-list HACKBLOCK_HOSTS line 1 extended permit ip any 66.192.168.0 255.255.255.0 (hitcnt=65138) 0x6402ac20
enp-amer-clt-pix525-a# sh access-list HACKBLOCK_HOSTS
access-list HACKBLOCK_HOSTS; 1 elements
access-list HACKBLOCK_HOSTS line 1 extended permit ip any 66.192.168.0 255.255.255.0 (hitcnt=65245) 0x6402ac20
enp-amer-clt-pix525-a# sh access-list HACKBLOCK_HOSTS
access-list HACKBLOCK_HOSTS; 1 elements
access-list HACKBLOCK_HOSTS line 1 extended permit ip any 66.192.168.0 255.255.255.0 (hitcnt=65285) 0x6402ac20

Disable http inspection in global_policy FWSM

I am running 4.0(7) and we are experiencing some issues with downloads - specifically http downloads. Anything with an https link works fine.
Looking into the config on the FWSM i see that under the global_policy we are inspecting http
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
inspect http
I would like to remove inspect http as a test to see if this is causing our problems, but am unsure of the impact of doing this?
Also it is strange as this option has been there for a long time and our download issues have only recently started to happen, it does seem to be only for http links though?
I don't really understand what the inspection engine does?

Well,
I removed the http inspection and it broke all inbound and outbound web services!
Then I discover this
url-server (WEB-Sense) vendor websense host 10.*.*.* timeout 30 protocol TCP version 1 connections 5
filter url except 10.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0 allow
This web-sense server is down and no longer used.
But am I correct to assume that the prescense of this config caused a problem as all http was trying to go via the Websense but with the http inspection enabled it is able to go out direct?
I am unclear as to exactly how the inspection and the url-server / filter url commands interact.
Thanks
Roger

HTTPS Inspection and MAC OS X Clients

Hi together,
we want to enable HTTPS Inspection at our TMG Cluster....but the counterpart is, Mac OS X Clients wont be able to connect to SSL Sites after we activate it.
So i am aware of this blogpost
http://blogs.technet.com/b/isablog/archive/2012/04/20/mac-os-clients-fail-to-access-ssl-websites-after-you-enable-https-inspection-in-forefront-tmg-2010.aspx
We had a certificate generated by our own internal CA, generated like described in this blogpost
http://blogs.technet.com/b/isablog/archive/2014/08/29/how-to-create-a-cng-httpsi-cert-using-a-2008r2-ca.aspx
After we faced the problems with os x we didnt do more research and renewed the certificate with the options of the second blogpost but as Windows Server 2008 CA Cert.
But still, MAC OS X (Safari) cant reach HTTPS Sites, Firefox on MAC OS X works fine.
I`ve downloaded the certificates to check if it is ASCII or Unicode...here are the results:
Aussteller:
CN=TMG HTTPS CNG Inspection
[0,0]: CERT_RDN_PRINTABLE_STRING, Länge = 40 (40/64 Zeichen)
2.5.4.3 Allgemeiner Name (CN)="TMG HTTPS CNG Inspection"
Antragsteller:
CN=*.facebook.com
O=Facebook, Inc.
L=Menlo Park
S=CA
C=US
[0,0]: CERT_RDN_PRINTABLE_STRING, Länge = 2 (2/2 Zeichen)
2.5.4.6 Land/Region (C)="US"
55 53 US
55 00 53 00 U.S.
[1,0]: CERT_RDN_PRINTABLE_STRING, Länge = 2 (2/128 Zeichen)
2.5.4.8 Bundesland oder Kanton (S)="CA"
43 41 CA
43 00 41 00 C.A.
[2,0]: CERT_RDN_PRINTABLE_STRING, Länge = 10 (10/128 Zeichen)
2.5.4.7 Ort (L)="Menlo Park"
4d 65 6e 6c 6f 20 50 61 72 6b Menlo Park
4d 00 65 00 6e 00 6c 00 6f 00 20 00 50 00 61 00 M.e.n.l.o. .P.a.
72 00 6b 00 r.k.
[3,0]: CERT_RDN_PRINTABLE_STRING, Länge = 14 (14/64 Zeichen)
2.5.4.10 Organisation (O)="Facebook, Inc."
46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e Facebook, Inc.
46 00 61 00 63 00 65 00 62 00 6f 00 6f 00 6b 00 F.a.c.e.b.o.o.k.
2c 00 20 00 49 00 6e 00 63 00 2e 00 ,. .I.n.c...
[4,0]: CERT_RDN_UTF8_STRING, Länge = 14 (14/64 Zeichen)
2.5.4.3 Allgemeiner Name (CN)="*.facebook.com"
So i think the problem is the last one while this is still as utf8 issued...but why? Shouldn`t this also a printable/ASCII one? How can i fix it?
The template which generated the TMG Certificate has the following settings:
General
Validity: 10 Years
Renewal period: 2 Years
Issuance Requirements
Suspended Templates
Extensions
Application Policies: Code Signing (Codesignatur), Private Key Archival (Archivierung des privaten Schlüssels), Server Authentication (Serverauthentifizierung)
Basic Constraints: everything is checked
Certificate Template Information: -
Key Usage: Digital signature, Signature is proof of origina (nonrepudiation), Certificate signing, CRL signing, Make this Extension critical
Have you any ideas why i still get utf8 subjects?
Thanks for your help in advance

Hi Vasu,
isn`t this needed to issue a cng certificate (
http://blogs.technet.com/b/isablog/archive/2014/08/29/how-to-create-a-cng-httpsi-cert-using-a-2008r2-ca.aspx ) ?
I give it a try and give you a Status update.
Regards
edit
so while it isnt possible to use sha256, i am unable to issue cng certificates after using a 2003 based CA Template. So this cant be a solution....

Default HTTP inspection map

Hi guys.
When configuring Inspect HTTP there is an option to use Default HTTP Inspection Map.
Its used here as an example on the documentation;
From the Select HTTP Inspect Map window, check the radio button next to Use the Default HTTP inspection map. The default HTTP inspection is used in this example. Then, click OK.
However I cannot actually see anywhere what these Default settings are.
For example; it is possible to set varying security levels when configuring manually (low-medium-high) with differing options in each, but what are the security level and specific settings when choosing default?
I cannot find any reference to these.
If anyone can help that would be great.
Thanks.
Mike

I'm not sure which reference you're citing, but in ASDM if you go to "Configuration > Firewall > Objects > Inspect Maps > HTTP" and click on "Add" you will see a dialog box with a slider which shows what each level consists of by default. You can further customize by choosing the Details, URI Filtering, etc.
(Very very few people actually use the built-in http inspection and instead use either a 3rd party solution like WebSense URL filtering or a Proxy server like WSA or BlueCoat or else use the ASA CSC module of NGFX CX module with AVC and WSE.)
See the following screenshot for what I wan talking about in my first paragraph:

HTTP 500 issue

Hi,
I finished most of setup of R12. i am able to login the DB using apps. but i got HTTP 500 issue when going to
http://win03dell.MyHome.com:8000/OA_HTML/AppsLogin
like
http://dl.dropbox.com/u/40211031/t29.jpg
Thanks & Best Regards,
HuaMin

i run this but have got
F:\oracle\test02\apps\apps_st\appl\ad\12.0.0\bin>perl -x ojspCompile.pl –compile –flush
'perl' 不是內部或外部命令、
可執行的程式或批次檔。
the Chinese means 'perl' is not an internal or outside commandUse the absolute path to the perl executable file (or source the application env file first before running the command).
when running this i also got the same error
F:\oracle\test02\apps\apps_st\appl\ad\12.0.0\bin>adopmnctl.cmd status
'adopmnctl.cmd' 不是內部或外部命令、
可執行的程式或批次檔。What does that mean in English :) ?
Thanks,
Hussein

Toying with https inspection. Do access lists now have to be in decryption policies?

Hello,
I am toying with https inspection. I am wondering now with the WCCP redirect from the firewall for https on two of our test IP's (before rolling it in production), if I need to basically duplicate all of my Access Policies on the Decrypt Policies. Is Access Policies just for http websites and Decrypt Policies just for https websites, or am I wrong?
Lets say you want facebook blocked. In Access Policies it is blocked by default, unless you fall into an upper category like AD group Management for example. Well facebook has both an http and an https (now increasingly more common) site. So could they just circumvent this block by typing in https? They can do that now (since were not inspecting https), but we want to put a stop to that.
I tested and put drop for social networking but we just get a page cannot be displayed then on our test machine. We don't even get redirected to our server hosting the "you are blocked" page.

Ok so its fine to have a global decription policy that has everything set to monitor, and just continue to let the access policy do all the work?
At least if you "hit" on an access policy, the WLC forwards us to our customized block page. In decryption policy if you hit drop, quite understandably so you just get a page cannot be displayed (since it is dropped of course).
When would the "decrypt" option be a good idea?

CSM 3.3.0, FWSM 4.0(6), HTTP Inspection

Hi,
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin-top:0in;
mso-para-margin-right:0in;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0in;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
i have a firewall module (FWSM) ,(version 4.0(6)) which is managed with CSM (3.3.0). There is a problem about regular expression configuration with CSM. HTTP Inspection with regular expression is configured with ASDM successfully but this configuration is not deployed with CSM on FWSM. It seems CSM does not support regular expression for FWSM. The following picture shows that CSM support HTTP advanced inspection configuration only for ASA7,2 and PIX7.2. i need to know does CSM 4.0 has this limitation or is there any solution for this CSM version?

Here is the guide for Flex configs http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/3.3/user/guide/tmplchap.html
There is no predefined flex config for the http inspection. But you can create a new Flex config that has the commands
regex ...class-map type inspect http match header host regex ...
The Flex config in CSM will be deploying the commands as if you were doing it with CLI.
I hope it makes sense.
PK

Potential Impact of Disabling Default HTTP Inspection Policy

I have a 5500-series firewall configured with basic HTTP inspection via the default global policy-map. The software for this firewall is recent 8.2(x).
Some questions:
1. I am under the impression that default HTTP inspection will do basic validation of RFC compliance for HTTP traffic without any custom configuration. All such traffic is inspected by the appliance. Am I correct in this understanding?
2. If so, would basic HTTP inspection create the potential for additional latency in the environment for matched traffic?
3. Would removing the policy via the "no inspect http" command within the global policy-map be service disrupting? Would I see any noticeable impact to HTTP traffic by doing this?
Thank you for your responses in advance.
Jeff

Hi,
These are the response to your queries:-
1) Yes ,HTTP inspection will check all the connections destined to port 80 through the ASA device as per the RFC standards.
2) Might be yes , As the HTTP connections are the major amount of traffic on the ASA device , too much traffic have to be inspected by the ASA device and re-assembling will also cause the ASA device to do some extra processing.
3) No , I think you would reduce the processing for the ASA after disabling this inspection.
This would not cause any disruption in the traffic as it is not applied on the existing connections but only on the new connections which are made through the ASA device after the policy is modified.
Also , check this:-
http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113393-asa-troubleshoot-throughput-00.html
Thanks and Regards,
Vibhor Amrodia

Dropbox and HTTPS inspection

Greetings, community!
We have a trouble with Dropbox application connection to their servers through our TMG servers array.
HTTPS-Inspection is enabled.
So, the error in the logs is:
Failed Connection Attempt
Log type: Web Proxy (Forward)
Status: 0x80090325
Rule: Allow Web Access for All Users
Source: Internal (10.0.128.15:53328)
Destination: External (108.160.165.11:443)
Request: client60.dropbox.com:443
Filter information: Req ID: 0ab2df8b; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: https-inspect
User: anonymous
Additional
information
Object source: Internet (Source is the Internet. Object was added to the cache.)
Cache info: 0x0
Processing time: 0 MIME type:
I try to:
1. Disable HTTPS-Inspection for *.dropbox.com destination
2. Enable direct access to *.dropbox.com
Same trouble.
Does anyone seen same problem?

Hi,
your clients are configured as Webproxy clients (TMG proxy in browser specified)?
Dropbox may not use the proxy settings from your browser.
Please try to set the proxy on the client with NETSH WINHTTP SET PROXY
regards Marc Grote aka Jens Baier - www.it-training-grote.de - www.forefront-tmg.de - www.galileocomputing.de/3570

BT Infinity HTTPS connection issues- anyone else?

Hi all.
Any advice would be greatly appreciated.
I have been having considerable problems with HTTPS sites over the past few months - timing out, unable to make payments online with ClickSafe - Lloyds Bank, Natwest, NEXT, National Lottery. Some HTTPS sites load eventually but usually very very slowly or time out.
This issue is across all my devices - Macbook Pro, iPad Air, Samsung Tablet, Windows 8 Laptop, x3 iPhone 5.
If I switch WiFi off on my iPhone I can make payments over the mobile phone network fine but as soon as I switch WiFi on the problems occur again. I took my Laptop to a friends house and used their TalkTalk Broadband and no issues, all worked fine.
I have had 2 HH4 and now a HH5 and the problem still occurs.
I have Changed numerous settings, undertaken numerous reboots and complete resets to no avail.
I have enabled firewalls and disabled firewalls, changed MTU and numerous other possible fixes, but again none have worked.
I have paid for BT Tech Expert support who have been very helpful and always called back when they have said they would but they do not know what the problem is and are still working on it. Next call on Monday night.
I found this very long thread starting in 2011 and ending in February 2013, where BT customers were experiencing the exact same problems in the South West of England and it turned out to be a network issue that was resolved but it does not explain how it was resolved!
https://community.bt.com/t5/BT-Infinity-Speed-Connection/BT-Infinity-and-https-connection-issues/td-...
I am in Newcastle upon Tyne and would be grateful if anyone could let me know if they are having the similar problems?
Thanks for your help.
BT Infinity 2 - 75/16 Mbs

To make sure that BT web help is disabled, look here.
http://preferences.webaddresshelp.bt.com/selfcare/
To try changing DNS server on your Windows 8 laptop, see this Microsoft note.
http://answers.microsoft.com/en-us/windows/wiki/windows8_1-networking/how-to-change-ipv4-dns-server-...
You can use 8.8.8.8 as they suggest, as that is Google public DNS.
If that fixes the problem on the laptop, it would point to a problem with BTs DNS servers.
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.

ContentType in HTTP Header issue while sending webservice request

I have a client application deployed on weblogic10.3.4 which access a remote web application (on websphere5.1).
The soap request fails because WebSphere5.1 does not accept double quote around utf-8 in ContentType header of HTTP.
e.g:
Content-Type: text/xml;charset=utf-8 is valid
Content-Type: text/xml;charset="utf-8" is not valid
This can be fixed on glassfish by upgrading metro library.
But how can I fix this problems on weblogic server?
I found weblogic8.1 doc which says this issue has been fixed (CR198996), but why does it still exist on 10.3.4?
Any suggestions would be appreciate.

Hi _MiRichter,
Well Done!
Thank you very much for sharing the solution to us.
Best Regards,
Amy Peng
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Https redirection issue for Wireless Guest CWA - ISE 1.3

Our Setup is
ISE 1.3 (Patch level 2) running on ACS 1121
2 nodes clustered with Admin, monitoring, policy service enabled ( Primary and Secondary ).
Configured SSID Guest for Centralized web authentication with ISE.
We have issues in web redirection with chrome . It is not redirecting to the ISE page but rather showing " Page cannot be displayed".
By default chrome is pointing to https. For example if we type https://google.com it is not redirecting to ISE page. But when I specify the same as http://google.com it works.
There is no issue with IE, Firefox as it is redirecting to ISE page with default https and i can see it is hitting our rule.
Please advice.

Hi Neno
They are using a third party certificate (digi cert) for client auth. They have confirmed even if they use a self-signed-cert the result is same.
So basically none of the https page is not loading. If we manually browse some https site from Firefox, IE the result is same showing " page cannot be displayed".
Redirection to https is the problem which i have never faced with my other customer. This is the upgraded version of ISE from 1.2 to 1.3.

Cache server getcert http request issue

Hi,
We are using third party repository for documents archiving and storage. And we have separate application for connecting third party repository to the SAP.
We have installed content server and cache server on the system where SAP was installed.
Now we want to run getcert HTTP request from our application so that we will get the certificate from SAP cache server. What we need to do in order to achieve the same? Or in other words how we can make the connectivity between cache server and the third party repository?
We have verified the following URLs
http://10.224.1.37:1090/ContentServer/ContentServer.dll?serverInfo
http://10.224.1.37:1095/Cache/CSProxyCache.dll?serverInfo
(Where 10.224.1.37 is the IP address of the system where SAP is installed)
for content server and cache server respectively.
The URL for cache server was giving the correct server information but URL for content server is not at all showing any server information even after running for long time.
Could you please tell me step by step by procedure and configuration steps for running get cert request to cache server? We want to know how to send the getcert request to third party content management system from cache server.
We have given the following URL in http get functional module but we are getting a 400 bad request response
http://10.224.1.37:1095/Cache/CSProxyCache.dll?getcert&pversion=0046&conrep=RH
Where RH is pointing to the third party content server (through transaction oac0).
Thanks,
Ravi

Hi All,
I am also facing the same problem, Please help us out to solve this issue.
Thanks in advance
Regards
Harshavardhan.G

HTTPS inspection issue

Similar Messages

Maybe you are looking for