rad errors : "Failed to parse CP Site Response.", response expired several days ago.

[fcamus]

Hi,

I have two clusters of CP 16200 running R80.40 T192 with thousands of internet users.

I started url filtering blade to block some application using https categorization (no https inspection).

It's working as expected, but i have now hundreds of "Failed to parse CP Site Response" logs in smartconsole.

$FWDIR/log/rad_events/Errors is full of error files (hundreds per minute).

In attach an example of flow error (proxy IP changed)

We are not using anti-virus or anti-bot.

I opened a case (SR #6-0003583350)  but for now, it doesn't help.

I have a strange "response expired" message in the error files : 

---------------------

[rad_xml_urlf.cpp:350] CRadXmlUrlf::listen: [INFO] Found response UTC: 1680631251
[rad_xml_urlf.cpp:359] CRadXmlUrlf::listen: [ERROR] response expired: seconds difference: 68797 now: Wed Apr 5 15:07:28 2023
response time: Tue Apr 4 20:00:51 2023

---------------------

In this example, response time is 68797s (=19 hours) before current time. This value varies from 40000 up to 400000s = more than 4 days.

I'm looking for the possible cause of such errors.

thanks,

fred

[fcamus · Accepted solution]

Hi

I reply to my post.

After a (painfull) case where TAC asked me to do some tuning, modify my custom application objects, the case reached R&D where it was rapidly identified that rad process refused the cached proxy reply.

The problem was resolved as soon as the proxy administrator disabled cache for cws.checkpoint.com

If rad doesn't accept cached response, it would be better to use the cache-control functionalities of http protocol !

So if you use proxy, verify that caching is disabled. Hope this will help some members.

fred