Viewing incidents

Use the Configure > SSL > Incidents > Incident List tab to see a report of those times when clients received an access denial message.

Every node in a cluster has its own incident list.

Incidents that are added or modified by the administrator are copied around the cluster (synchronized).

Unexpected incidents that result in an access denial message are not synchronized in the cluster.

Use the fields in this report to specify how Content Gateway treats requested access to a site in the future.

To view a specific incident in the local list, enter the ID number or URL and click Search Node.

If the node is part of a cluster and you want see all instances of the ID or URL, in all lists, click Search Cluster.

After performing a search, to restore the complete local list, click Show All in Node.

When the list is very large, Show All displays only the first 2,500-3,000 records. Use the scroll bar to scroll through the list. Use the ">" and "<" buttons to view the next or previous page.

The incident report

To sort on any column, click the small triangle next to the column heading.

The incident report contains these fields:

Field

Description

Node

The name of the Content Gateway node on which the list entry is located.

The incident ID number assigned by the system, also called the Ticket ID. Help Desk can ask the user for the Ticket ID in the error message and quickly retrieve it from the Incident List.

The end user sees the Ticket ID and a denial message.

Status

Determines how Content Gateway will treat this website in the future. Four conditions are possible:

Allow

Users can access the site even if the certificate is not valid. Traffic is decrypted, and certificate checking is disabled.

Blacklisted

The site is completely blocked. Users cannot access this site even if the Verification Bypass is configured.

Block

If certificate verification fails, access to the website is blocked, unless Verification Bypass is configured, in which case the block page includes a "Visit site anyway" button. See Bypassing verification.

Tunnel

The site is tunneled. Traffic is not decrypted and Content Gateway does not check the certificate. Tunneling can be used to bypass inspection of trusted sites and improve performance.

Note: Tunnel by URL does not work with all transparent proxy traffic. See Adding websites to the Incident List.

Use the drop-down list in the Action column to change the status of a site.

Type

Indicates whether the site was added based on its URL or its certificate. It is recommended that administrators add sites to the Incident List by certificate. See Adding websites to the Incident List.

URL

The URL of a site whose certificate could not be validated.

Message

Offers the option to edit the error message. See Changing the text of a message for information on customizing error messages. The pencil and the magnifying glass icon are both links. See Viewing incident details for details.

Action

Offers the option to change the status of an incident and to delete the incident. See Deleting an incident.