Resolved and known issues

Cloud Web Protection Solutions | 27-Jul-2016

For HTTP requests that reach the cloud service via firewall redirect, the Filtering Source attribute now correctly shows Firewall redirect in reports. Previously, "Cloud connection" was displayed.

The correct Help page is now displayed for the Reporting > Endpoint Auditing page in the cloud portal when an administrator clicks Help > Explain this Page.

The expected results are shown when the report filter "Threat Name not equal to None" is selected. Previously, the report returned values including "None."

Data Security

An incident is recorded when a user uploads content that violates Data Security policies to Google Drive. If Data Security blocking is enabled, the upload is blocked.

Blocking

To resolve an issue that caused certain websites to always be blocked when the "block files of unknown type" option was selected, empty files are now classified as type "empty," rather than type "unknown."

The correct icon is now displayed in the title bar for "Use Quota Time" block pages.

Query page

When a user accesses the cloud portal query page to find out if a client is connecting to the cloud service via firewall redirect, the query page now correctly reports that "Yes: you are using the TRITON AP-WEB Filtering Proxy Server."

Known issues

The following are known issues in this version of the cloud web protection products:

IPsec tunneling

For SSL decryption to work with IPsec tunneling, SSLv3 must be disabled in Internet Explorer.

Basic authentication does not work for iTunes with IPsec tunneling.

Using authentication bypass settings to force NTLM, basic authentication, or the welcome page does not work with IPsec tunneling if a URL condition is present.

Cisco ASA firewalls earlier than version 9.1 with multiple security contexts enabled cannot use IPsec tunneling.

NTLM for non-domain users is not supported.

Some web pages do not load properly in Safari after successful user authentication. The workaround for this is to ensure the Block cookies option is set to Never in Safari's privacy preferences.

Authentication

If an end user is browsing with Internet Explorer and their system clock is set to a future time or date, session-based authentication fails and is repeatedly requested because IE considers the session cookie to be expired. To avoid this, ensure the system clock is set correctly.

If a roaming user authenticates using single sign-on with Oracle Identity Federation, the secure authentication form is intermittently displayed if the session times out.

Firefox sometimes fails to load the page correctly when an end user re-authenticates after session timeout. This occurs only if the session timeout is set to a very short time period.

The New Tab page in Chrome displays "Internal Server Error" when a user authenticates using a cookie-based method (secure form authentication or single sign-on). To work around this, open a new tab in the browser and re-authenticate to browse successfully.

If a roaming user authenticates using single sign-on with a supported provider, and their policy also mandates an Acceptable Use Policy (AUP), the compliance page appears only on the second site they browse to, and not on the first site which triggered their authentication.

When using Internet Explorer, users may receive the welcome page for basic authentication instead of the welcome page for secure form-based authentication after the secure form-based authentication session expires. They can either restart the browser or browse to a different site.

i-Series appliances

In cases where the appliance self-signed certificate is used or when the CA certificate is not loaded on clients, Chrome blocks the connection and displays an error page.

To proceed past this error page, ensure the browser page is the active window, and then type proceed. For Chrome versions 33 and 34, type danger.

To prevent this issue occurring, end users should not use the appliance self-signed certificate and should load the CA on their clients.

The YouTube for Schools feature does not work for HTTPS sites. To work around this, you can redirect this traffic to the cloud: ensure you enable SSL decryption in your policy and under SSL Decryption Categories, set the YouTube category to Decrypt.

The appliance does not currently support authentication decryption bypass for custom categories.

When using a Windows XP machine with Internet Explorer 8 (or below), HTTPS connections are not supported on i-Series appliances.

If you add a custom protocol with a name containing non-ASCII characters, an error occurs on the appliance and the new protocol is not added.

The appliance does not support browsing directly to full URLs (i.e., those including a full path to a specific page) in custom categories for SSL traffic. Using the host name only is supported.

Google redirect does not work correctly if a user browses to http://www.google.com and Google does not automatically change this to https://www.google.com. In this case, traffic is not redirected to the cloud service and Google applies its own redirect to the appropriate site for the country it detects, rather than the options set in the cloud portal. If the country site selected by Google conflicts with your cloud settings, add "google.com" to the Always analyze list on the Web Content & Security tab to ensure traffic redirection to the cloud.

Endpoint

The Endpoint Auditing report has the following known issues:

All times in the report are based on the time zone of the machine used to view the report, rather than the end-user machine on which the endpoint is installed.

If communication to the endpoint client machine is lost or the machine enters suspend or hibernate mode, this change of state is not reflected in the report.

If an end-user machine is shut down, the endpoint is automatically enabled on restart regardless of its previous state, and this is not reflected in the report.

If the endpoint is automatically installed from the cloud and then immediately disabled, end user details are not associated with a policy, and the disable action is not reflected in the report until the endpoint is re-enabled and the end user starts browsing.

When an endpoint version is upgraded, either manually or via GPO, the endpoint is enabled even if it was previously disabled. This is not reflected in the report.

When users install an up-to-date version of Windows endpoint, the endpoint summary report shows the Windows endpoint version as outdated, because the Mac endpoint version has a higher number than the Windows version.

On machines where the Mac endpoint is installed, for certain types of users (e.g., root), it looks like they can edit the network proxies page. However, any changes made here are not saved. The endpoint's resistance to tampering continues to work.

It is possible to delete the Mac endpoint in the System Preferences pane. This will not affect the operation of the endpoint. If this occurs, use the command line tools instead of the user interface to get the debug logs and to uninstall the endpoint.

To have the endpoint re-appear in System Preferences, copy "/Library/PreferencePanes/WebsenseEndpoint.prefPane" to the same directory from another machine on which the Mac endpoint is installed.

Policies

For users whose organizations choose to display the acceptable use policy compliance page, this page appears for each different browser they use within the frequency period selected (1, 7 or 30 days). For example, if they browse using Internet Explorer and Chrome within the same time period, the page appears twice, and they must agree to accept the page twice. Note that when using the endpoint auto-install feature, this same issue occurs.

The compliance page appears the first time an end user browses to an HTTP site and does not appear if the user browses to HTTPS or FTP sites. Note that when using the endpoint auto-install feature, this same issue occurs.

In the File Blocking tab, file extensions for HTTPS remain blocked even if they are set to Allow.

End users may have to clear their cache for the Google redirect feature to work correctly.