View source for Accessing business applications through SafeSquid


Accessing business applications through SafeSquid

There have been several instances where it has been reported that certain applications which the organizations use doesn't work through SafeSquid. This article describes a generalized way of identifying what's wrong with the application and solving it.

There are more than one reasons because of which the application may not work through SafeSquid. They can be listed as:

1) The applications may have certain URLs which are getting blocked by SafeSquid. You need to allow those URLs by creating policies so that the application works properly. To identify whether URLs are getting blocked, you need to carefully observe the extended log of SafeSquid by verifying if the status code is '403' (which means blocked) for any of the requests sent by the application. To view the logs, you can run the following command by taking the SSH access of the SafeSquid server:

'''<code>&nbsp;tail -F /var/log/safesquid/extended/extended.log | grep "192.168.0.17" | grep '403'</code>'''

&nbsp;

Where, "192.168.0.17" is the IP of the machine accessing the application. You will be displayed with something similar to the following log line. The status code 403 describes the blocked URLs.

&nbsp;
<div style="background:#eee;  border:1px solid #ccc;  padding:5px 10px">"1496477492.50.1.2386.zx5NhVkA9enUdJEC"&nbsp;&nbsp; &nbsp;"50"&nbsp;&nbsp; &nbsp;"1"&nbsp;&nbsp; &nbsp;"03/Jun/2017:13:41:32"&nbsp;&nbsp; &nbsp;"78"&nbsp;&nbsp; &nbsp;"403"&nbsp;&nbsp; &nbsp;"0"&nbsp;&nbsp; &nbsp;"0"&nbsp;&nbsp; &nbsp;"0"&nbsp;&nbsp; &nbsp;"-"&nbsp;&nbsp; &nbsp;"192.168.0.17"&nbsp;&nbsp; &nbsp;"anonymous@192.168.0.17"&nbsp;&nbsp; &nbsp;"GET"&nbsp;&nbsp; &nbsp;"[http://www.bing.com:80/search?q=porn&qs=n&form=QBLH&sp=-1&pq=porn&sc=0-0&sk=&cvid=ADEF7442BA9A41FEB3857DD679E8124F http://www.bing.com:80/search?q=porn&qs=n&form=QBLH&sp=-1&pq=porn&sc=0-0&sk=&cvid=ADEF7442BA9A41FEB3857DD679E8124F]"&nbsp;&nbsp; &nbsp;"[http://www.bing.com/ http://www.bing.com/]"&nbsp;&nbsp; &nbsp;"Mozilla<br/> /5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0"&nbsp;&nbsp; &nbsp;"text/html"&nbsp;&nbsp; &nbsp;"Profiles"&nbsp;&nbsp; &nbsp;"-"&nbsp;&nbsp; &nbsp;"192.168.17.1:8080"&nbsp;&nbsp; &nbsp;"TCP_DENIED"&nbsp;&nbsp; &nbsp;"DIRECT"&nbsp;&nbsp; &nbsp;"safesquid"&nbsp;&nbsp; &nbsp;"www.bing.com"&nbsp;&nbsp; &nbsp;"bing.com"&nbsp;&nbsp; &nbsp;"www.bing.com"&nbsp;&nbsp; &nbsp;"bing.com"&nbsp;&nbsp; &nbsp;"0"&nbsp;&nbsp; &nbsp;"LUNCH"&nbsp;&nbsp; &nbsp;"ADMINS"&nbsp;&nbsp; &nbsp;""&nbsp;&nbsp; &nbsp;"Firefox Browser,Browsers,Bing,Search Engine,Bing Search,Bing UnSafe Search"&nbsp;&nbsp; &nbsp;"pornography,searchengines"&nbsp;&nbsp; &nbsp;""&nbsp;&nbsp; &nbsp;"-"&nbsp;&nbsp; &nbsp;"-"&nbsp;&nbsp; &nbsp;"GLOBAL BLOCK"</div> 
&nbsp;

The log line legend mentioning what each field means is shown below:

&nbsp;
<div style="background:#eee;  border:1px solid #ccc;  padding:5px 10px">"record_id"&nbsp;&nbsp; &nbsp;"client_id"&nbsp;&nbsp; &nbsp;"request_id"&nbsp;&nbsp; &nbsp;"date_time"&nbsp;&nbsp; &nbsp;"elapsed_time"&nbsp;&nbsp; &nbsp;"status"&nbsp;&nbsp; &nbsp;"size"&nbsp;&nbsp; &nbsp;"upload"&nbsp;&nbsp; &nbsp;"download"&nbsp;&nbsp; &nbsp;"bypassed"&nbsp;&nbsp; &nbsp;"client_ip"&nbsp;&nbsp; &nbsp;"username"&nbsp;&nbsp; &nbsp;"method"&nbsp;&nbsp; &nbsp;"url"&nbsp;&nbsp; &nbsp;"http_referer"&nbsp;&nbsp; &nbsp;"useragent"&nbsp;&nbsp; &nbsp;"mime"&nbsp;&nbsp; &nbsp;"filter_name"&nbsp;&nbsp; &nbsp;"filtering_reason"&nbsp;&nbsp; &nbsp;"interface"&nbsp;&nbsp; &nbsp;"cachecode"&nbsp;&nbsp; &nbsp;"peercode"&nbsp;&nbsp; &nbsp;"peer"&nbsp;&nbsp; &nbsp;"request_host"&nbsp;&nbsp; &nbsp;"request_tld"&nbsp;&nbsp; &nbsp;"referer_host"&nbsp;&nbsp; &nbsp;"referer_tld"&nbsp;&nbsp; &nbsp;"range"&nbsp;&nbsp; &nbsp;"time_profiles"&nbsp;&nbsp; &nbsp;"user_groups"&nbsp;&nbsp; &nbsp;"request_profiles"&nbsp;&nbsp; &nbsp;"application_signatures"&nbsp;&nbsp; &nbsp;"categories"&nbsp;&nbsp; &nbsp;"response_profiles"&nbsp;&nbsp; &nbsp;"upload_content_types"&nbsp;&nbsp; &nbsp;"download_content_types"&nbsp;&nbsp; &nbsp;"profiles"</div> 
&nbsp;

2) One of the other reasons may be, you have authentication and/or HTTPS inspection enabled and the application may not support the authentication (Negotiate/Basic) and/or HTTPS inspection. Authentication failure can be verified by observing the logs and checking for a status code of '407' which indicates "Invalid SSO Auth" (if you have enabled Negotiate authentication)

{{Seo|keywords=debug secure web gateway|description=How to debug if an application is not working through your Secure Web Gateway}}

[[Category:How To]]