Options

Application being blocked - ZScaler

CSiemCSiem
edited January 2021 in Firebox - Proxies

I have a client who requires the use of an application called ZScaler on his PC. With the ZScaler app loaded and active the client has encountered numerous application and internet browsing issues, but only behind the T35, no other generic firewalls.
Here is a short piece of traffic log - i am wondering what i have to configure to allow this application to work? The 165.225.x.x IP is a ZScaler cloud server that the PC client connects to.

Any help on configuring the T35 to allow this app to function would be appreciated.

2021-01-04 12:50:07 Deny 192.168.9.113 165.225.60.24 HTTP Proxy Server 54697 443 Home External Application identified 115 64 (HTTPS-proxy-00) proc_id="firewall" rc="101" msg_id="3000-0149" src_ip_nat="-redacted-" tcp_info="offset 5 A 3730587613 win 370" app_name="HTTP Proxy Server" app_cat_name="Tunneling and proxy services" app_id="68" app_cat_id="11" app_beh_name="Communication" app_beh_id="2" geo_dst="USA"
2021-01-04 12:50:07 Deny 192.168.9.113 165.225.60.24 HTTP Proxy Server 54699 443 Home External Application identified 91 64 (HTTPS-proxy-00) proc_id="firewall" rc="101" msg_id="3000-0149" src_ip_nat="-redacted-" tcp_info="offset 5 A 2164737846 win 370" app_name="HTTP Proxy Server" app_cat_name="Tunneling and proxy services" app_id="68" app_cat_id="11" app_beh_name="Communication" app_beh_id="2" geo_dst="USA"
2021-01-04 12:50:07 Deny 192.168.9.113 165.225.60.24 HTTP Proxy Server 54701 443 Home External Application identified 99 64 (HTTPS-proxy-00) proc_id="firewall" rc="101" msg_id="3000-0149" src_ip_nat="-redacted-" tcp_info="offset 5 A 3473683825 win 370" app_name="HTTP Proxy Server" app_cat_name="Tunneling and proxy services" app_id="68" app_cat_id="11" app_beh_name="Communication" app_beh_id="2" geo_dst="USA"
2021-01-04 12:50:07 Deny 192.168.9.113 165.225.60.24 HTTP Proxy Server 54704 443 Home External Application identified 99 64 (HTTPS-proxy-00) proc_id="firewall" rc="101" msg_id="3000-0149" src_ip_nat="-redacted-" tcp_info="offset 5 A 2737484059 win 370" app_name="HTTP Proxy Server" app_cat_name="Tunneling and proxy services" app_id="68" app_cat_id="11" app_beh_name="Communication" app_beh_id="2" geo_dst="USA"
2021-01-04 12:50:07 Deny 192.168.9.113 165.225.60.24 HTTP Proxy Server 54706 443 Home External Application identified 91 64 (HTTPS-proxy-00) proc_id="firewall" rc="101" msg_id="3000-0149" src_ip_nat="-redacted-" tcp_info="offset 5 A 1751746940 win 370" app_name="HTTP Proxy Server" app_cat_name="Tunneling and proxy services" app_id="68" app_cat_id="11" app_beh_name="Communication" app_beh_id="2" geo_dst="USA"

Comments

  • Options
    Bruce_BriggsBruce_Briggs

    The deny shows the application group identified is:
    "Tunneling and proxy services"
    And the app is "HTTP Proxy Server"

    You can add a HTTPS packet filter To: 165.225.60.24 or the domain name being accessed, which allow the desired access.
    Or you can unselect the blocking of "HTTP Proxy Server" in your application control profile used on the HTTPS proxy policy.

  • Options
    CSiemCSiem

    Great - thanks for the info, Bruce. Will post results when I can get it configured.

  • Options
    james.carsonjames.carson Moderator, WatchGuard Representative

    Hi @CSiem
    I edited your public IP out of your logs. In the future, please make sure any personally identifiable info is removed from any logs that you post.

    -James Carson
    WatchGuard Customer Support

  • Options
    CSiemCSiem

    Thanks Bruce - the HTTPS packet filter worked - just had to get a list of cloud IPs for the ZScaler application servers. Once i had those it worked perfectly.

Sign In to comment.