Blocked HTTPS requests are not getting a UserCheck message

[Jason_Nickel1]

We are running the Application and URL Filtering blades but do not have HTTPS Inspection enabled.

When users attempt to access blocked HTTPS categories or domains they are not getting the UserCheck block message  we have configured but rather the generic "Page Cannot Be Displayed" error from the browser. 

We are categorizing HTTPS requests, just not inspecting the content.

Logs are showing that the HTTPS content is being blocked as configured.

[Vladimir]

If you do not have HTTPS inspection enabled, this is an expected behavior. THere are a lot of posts in this forum addressing this. If you want user check on blocked HTTPS sites, enable HTTPS inspection.

[Nicolas_Bernier]

Hi,

As Vladimir said, without SSL inspection, it is an expected behavior in certain case.

Other than that, I did has a similar situation on my side and I ended up getting a custom fix from TAC becore the apache services responsible for showing the block message was basically "out of port" of overloaded.

It could be a similar situation on your side depending of the number of user you have. In my case, we had about 2K user total.

I suggest to you to open a case at TAC about this issue. Other than that, if you want, I may be able to find more information regarding the custom patch I was running in R80.10 regarding this issue.

Thanks

[Matt_Ricketts]

I would love to see more information about this custom fix you received. Even just your SR number if you don't want to go into details. I have a customer that is looking for something similar. A custom message or some other error other than Page cannot be displayed.

[Nicolas_Bernier]

Hi Matt,

Please look at SK85040.   You have couple of values to change on each member.

Let me know of it does the tricks for you !

Thanks

[Dmitriy_Chazov]

Hey.

And how does the gateway work in proxy mode? If it is transparent, then the message will not be displayed.

At me for example in not transparent mode and the message UserCheck is not display

[PhoneBoy]

You have the same basic issue in proxy mode, even where the firewall is the explicit proxy.

In explicit proxy mode, you can work around this with a proxy.pac file that tells the browser not to use a proxy for anything going to the firewall (which will allow the UserCheck page to display).