topic Re: Unable to update malware definitions from LAN in Endpoint

Unable to update malware definitions from LAN

StevePearson — Fri, 28 Jan 2022 18:07:24 GMT

Hi all,

I'm starting to roll out new laptop endpoints from the Infinity Portal. The problem is, while they update correctly when at home on broadband, they do not update whilst in the office behind the corporate firewall.

The firewall is a clustered pair of 5800's running R80.20.

The logs report "untrusted certificate detected" and refers to Kaspersy url's

I've tried whitelisting these url's in the https inspection policy but that doesn't help, but if I whitelist everything for a test machine, so it effectively doesn't do any inspection, then it works correctly, so it's definitely related to https inspection.

I was wondering if anyone else has come across this issue, or has any suggestions how to resolve this?

Thanks in advance!

Re: Unable to update malware definitions from LAN

Swiftyyyy — Sat, 29 Jan 2022 09:18:36 GMT

Correct me if I'm wrong, but arn't the kav8.zonealarm.com links running over http?
If you're forcing traffic over HTTPS, that would explain the lack of a valid certificate.

Re: Unable to update malware definitions from LAN

Chris_Atkinson — Sat, 29 Jan 2022 11:24:46 GMT

Are you seeing non-HTTP URLs different to those in sk116590?

One alternative is the Supernode approach, refer: sk171703

Re: Unable to update malware definitions from LAN

StevePearson — Sat, 29 Jan 2022 14:59:26 GMT

the links its having problems with are dc1.ksn.kaspersky-labs.com, and da.kaspersky.com

Re: Unable to update malware definitions from LAN

StevePearson — Sat, 29 Jan 2022 14:57:44 GMT

I'm seeing urls that are not listed in sk116590 yes, but I have to assume they should be https as they are using certificates.

dc1.ksn.kaspersky-labs.com

da.kaspersky.com

It sort of suggests that the sk may be out of date,.

I am seeing the same issue with the E85.40 as well the latest E86.20 clients.

I've attached the 2 log entries below

Re: Unable to update malware definitions from LAN

PhoneBoy — Sat, 29 Jan 2022 15:51:22 GMT

What precise JHF version?
Seems to me you would benefit from updating to a later release where SNI support would help you create the necessary exclusions.
Plenty of other reasons to upgrade from R80.20 as well,

Re: Unable to update malware definitions from LAN

StevePearson — Sat, 29 Jan 2022 16:41:11 GMT

The gateway is running Take 202 (205 planned for this coming week!)

We've white listed the urls but it makes no difference, do you think that this could be due to SNI?

There are plans in motion to upgrade, the target was R80.40, but wheels move so slowly we'll go with the recommended version once we get the go ahead to do it (R81.10 now I believe)