SRX

Hi Everybody

Today i configured the Enhanced Web filtering on SRX-100 (version 12.1R5.5) after installing a license for it,

everything configured right, but unfortunatly its not working,

in troubleshooting i found that the quiries sent to server without reply, then the traffic permitted by default fallback settings:

>show security utm web-filtering statistics
 UTM web-filtering statistics:
    Total requests:                      651
    white list hit:                              0
    Black list hit:                              0
    Queries to server:                  649
    Server reply permit:                   0
    Server reply block:                     0
    Custom category permit:          0
    Custom category block:           0
    Site reputation permit:             0
    Site reputation block:               0
    Cache hit permit:                      0
    Cache hit block:                        0
    Safe-search redirect:               0
    Web-filtering sessions in total: 4000
    Web-filtering sessions in use:   1
    Fallback:                       log-and-permit           block
          Default                               649               0
          Timeout                                0               0
     Connectivity                               2               0
Too-many-requests                      0               0

>show system license
License usage:
                                 Licenses     Licenses    Licenses    Expiry
  Feature name                       used    installed      needed
  wf_key_websense_ewf                   1            1           0    2014-09-16 00:00:00 UTC

-----------------------

traceoption and configuration files attached

anyone facing same issue ???

Attachment(s)

tracoptions logs.txt   305 KB 1 version

SRX100 Conf.txt   18 KB 1 version

Hi mahmoud,

Configuration looks good..

Please check the DNS setting on the firewall. see if you are able to ping rp.cloud.threatseeker.com from the CLI.

Regards
rparthi
 

Please Mark My Solution Accepted if it Helped, Kudos are Appreciated Too

hi rparthi

thank you for reply

the DNS server is configured and "rp.cloud.threatseeker.com" is pingabale, any other suggestions ??

Hi Mahmoud,

Can you provide the below output?

root@SRX> show security utm status

Also you can try restrting the utmd process as below.

root@SRX> show system processes extensive | match utm
 1352 root        1  76    0 25640K 17680K select 0  81:49  0.00% utmd

[edit]
root@SRX> start shell user root
root@SRX% kill -6 1352  ----------->>> PID as per "show system process" output

Thanks.

Suraj

Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too

Hi rsuraj

Thank you for your support

> show security utm status
UTM service status: Running

> show security utm web-filtering status

UTM web-filtering status:
    Server status: Juniper Enhanced using Websense server UP

Also i restart many time the service and device

for service i used the below command:

> restart utmd

i did  before many troubleshooting methods, without any benifit

i see that the main problem here from server side becuase the quiries sent but there are no reply from server side

traceoption file is attached if you would like to check it

Attachment(s)

SRX-Tracoptions.txt   637 KB 1 version

Hi Mahmoud Baroudi,

it looks like category request for each website to the rp-cloud threatseeker server is either not received or not processed by SRX.

is it possible for your upgrade your device to latest recommended release of 12.1X44-D35?

Regards
rparthi
 

Please Mark My Solution Accepted if it Helped, Kudos are Appreciated Too

Hi rparthi

I will try to upgrade to leatest recommended version (12.1X44-D35) and test the E-WF again.

thank you

Hi rparthi

The problem solved after upgrade the SRX to the recommended 12.1X44-D35 version

many thanks for your help

---

@Mahmoud Baroudi wrote:

Hi Everybody

 

Today i configured the Enhanced Web filtering on SRX-100 (version 12.1R5.5) after installing a license for it,

everything configured right, but unfortunatly its not working,

in troubleshooting i found that the quiries sent to server without reply, then the traffic permitted by default fallback settings:

 

>show security utm web-filtering statistics
 UTM web-filtering statistics:
    Total requests:                      651
    white list hit:                              0
    Black list hit:                              0
    Queries to server:                  649
    Server reply permit:                   0
    Server reply block:                     0
    Custom category permit:          0
    Custom category block:           0
    Site reputation permit:             0
    Site reputation block:               0
    Cache hit permit:                      0
    Cache hit block:                        0
    Safe-search redirect:               0
    Web-filtering sessions in total: 4000
    Web-filtering sessions in use:   1
    Fallback:                       log-and-permit           block
          Default                               649               0
          Timeout                                0               0
     Connectivity                               2               0
Too-many-requests                      0               0

 

>show system license
License usage:
                                 Licenses     Licenses    Licenses    Expiry
  Feature name                       used    installed      needed
  wf_key_websense_ewf                   1            1           0    2014-09-16 00:00:00 UTC

 

-----------------------

traceoption and configuration files attached

 

anyone facing same issue ???

 

 

---

12.1R5.5 is very very old and end of life version.Please upgrade to any latest/supported versions and check the behavior