Unable to update malware definitions from LAN

[StevePearson]

Hi all,

I'm starting to roll out new laptop endpoints from the Infinity Portal. The problem is, while they update correctly when at home on broadband, they do not update whilst in the office behind the corporate firewall.

The firewall is a clustered pair of 5800's running R80.20.

The logs report "untrusted certificate detected" and refers to Kaspersy url's

I've tried whitelisting these url's in the https  inspection policy but that doesn't help, but if I whitelist everything for a test machine, so it effectively doesn't do any inspection, then it works correctly, so it's definitely related to https inspection.

I was wondering if anyone else has come across this issue, or has any suggestions how to resolve this?

Thanks in advance!

[Swiftyyyy]

Correct me if I'm wrong, but arn't the kav8.zonealarm.com links running over http?
If you're forcing traffic over HTTPS, that would explain the lack of a valid certificate.

[StevePearson]

the links its having problems with are dc1.ksn.kaspersky-labs.com, and da.kaspersky.com 

[Chris_Atkinson]

Are you seeing non-HTTP URLs different to those in sk116590?

One alternative is the Supernode approach, refer: sk171703

[StevePearson]

I'm seeing urls that are not listed in sk116590 yes, but I have to assume they should be https as they are using certificates.

dc1.ksn.kaspersky-labs.com

da.kaspersky.com

It sort of suggests that the sk may be out of date,.

I am seeing the same issue with the E85.40 as well the latest E86.20 clients.

I've attached the 2 log entries below

[PhoneBoy]

What precise JHF version?
Seems to me you would benefit from updating to a later release where SNI support would help you create the necessary exclusions.
Plenty of other reasons to upgrade from R80.20 as well,

[StevePearson]

The gateway is running Take 202 (205 planned for this coming week!)

We've white listed the urls but it makes no difference, do you think that this could be due to SNI?

There are plans in motion to upgrade, the target was R80.40, but wheels move so slowly we'll go with the recommended version once we get the go ahead to do it (R81.10 now I believe)