Bluecoat Proxy

LnGrrrR · November 7th, 2005, 12:23 PM

Hey guys, has anyone worked with the Bluecoat Proxy here? For some reason, using one of our proxies through it I can get to the Cableone website no problem, but when I try going through the other, I get a TCP IP error (god I hate those...way to give me info on the problem pal...)

Anyways, can you think of any red flags to check? I looked through them and couldn't see anything that would allow one site and not the other...

Geforce · November 7th, 2005, 01:04 PM

As in, Bluecoat Winproxy?

If so I'm pretty advanced in it.

Explain your situation a little more, it almost sounds as the website you're trying to goto is pointed at your local IP address range so the lookup is just doing a loopback.

LnGrrrR · November 7th, 2005, 01:56 PM

Not sure if it's called "Winproxy" but the hardware is a bluecoat port 80 security appliance running SGOS 2.1.10.3.

We have two different proxies set up on this machine. One is the student network, and the other is for normal base users. We also have a medical proxy on-base.

Now, whenever I set up my internet to work with either the student or medical proxy, I have no problem connecting to the website. But whenever I configure it to use our normal proxy, we get a webpage that says, "TCP_ERROR"...

Problem Report: There was a communication problem.

Message ID : TCP_ERROR

Problem Description: The system was unable to communicate with the server.

Possible Problem Cause : The Web Server may be down. The Web server may be too busy. The Web server may be experiencing other problems, preventing it from responding to clients. The communication path may be experiencing problems.

Possible Solution : Try connecting to this server later.

Not very useful, I know. Now, we've got our firewall people tracking packets and whatnot, and from what I've heard (secondhand), we're seeing the packets leave, but getting no reply.

Any thoughts? Any specific questions you need to ask? (Thanks in advance for the help)

Geforce · November 7th, 2005, 03:00 PM

Ahh! I'm talking about the Windows Proxy sharing software from Bluecoat Technologies. Probably the same thing, just yours is a hardware version!

I'll have a go anyway...

When you say that when you configure it to use your normal proxy, what sort of services do you mean you are trying to connect? WWW? FTP?
Is so, are you manually entering the ports within the LAN settings of Internet Explorer? If you have configured your proxy port for the WWW to use anything bar 80, then you must manually configure your client program as well (in this instance, being Internet Explorer) to the same port as what you've just gone and entered into your proxy.

Now.. by default these settings are not usually passed onto the client machines until a specific option is checked (Something like dedicated) and that will usually grant the client machines access to whatever ports you've set your proxy to.

Like I said, I may be going down completey the wrong route here with the Software version of Bluecoat Winproxy, so let me know how you get on.

It seems odd that you can't just copy the settings from the medical proxy to your normal proxy.... surely that would work. Or maybe there's some configuration file within Bluecoat Winproxy.

It's a shame I don't have access to one to have a play about.. heh.

Anyway let me know.

LnGrrrR · November 7th, 2005, 03:09 PM

Yeah, these things are expensive.

And as far as copying configs, our med proxy and normal proxy have diff requirements, so we can't straight out copy. Both proxies are live.

As far as inputting info into Lan settings, in Internet Explorer we set up the IP address and port in the LAN settings page. You can use the IP of the proxy or the DNS name and then the port, both work. Every other internet page (that's supposed to that is

seems to come up fine except for this one which refuses to for some reason.

After checking the logs, the last time someone got to cableone.net (not sure whether it was www. or http://) through the normal proxy was the 30th, so we're asking other offices if they installed any patches on Sunday, as we have scheduled downtime on that day.

I've logged into the proxy and used visual policy manager to put in a rule allowing "Any" to get to *.cableone.net, but that hasn't affected anything. Plus it's a TCP error, and if it was the proxy stopping it I would think it would come up with the usual, "Smartfiler has denied this site because" page. But we can't even GET to the page it seems.

We're all kinda stuck on this one...

Geforce · November 7th, 2005, 06:10 PM

Now that is a weird one.

Cableone.net's IP address doesn't conflict with your Internal IP address does it? (lol)...

When I started work for the company I work for now, the Internal LAN was set to an external IP address, not one of the designated private subnets (192.168.XXX.XXX, 10.XXX.XXX.XXX and 172.16.XXX.XXX-172.31.XXX.XXX), which made me giggle.

Apart from that, I can't think of any other possible reason why your traffic wouldn't be routed back for that specific DNS lookup request.

I guess my next question would then be, what sort of support agreement/maintenance contract do you have on these Bluecoat Systems?

LnGrrrR · November 7th, 2005, 06:12 PM

Hehe, we're checking into that next. We're calling cableone and if that doesn't work we're going to call Bluecoat. I'm not sure what the warranty is..you know the old saying about the right hand knowing what the left hand is doing? Well the military has about 207 hands

Geforce · November 7th, 2005, 06:25 PM

Good Call.

Let me know if you get it sorted as I'd be intreguied to know the solution.

I'm just sorry that I couldn't help more - Although I think you're asking advice for a very niche market here, since I've not ever heard of the Bluecoat Hardware systems, and I'm the only one to reply (upto yet) hehe

Best of luck!

(And no, I've not heard of that saying - I guess I'm just not cultured/educated)

LnGrrrR · November 7th, 2005, 06:38 PM

lol It should have been the right hand NOT knowing what the left hand was doing.

here's the page for the product so you know

i'll check back here when we figure it out...

http://www.bluecoat.com/products/sg200/index.html

Geforce · November 7th, 2005, 06:56 PM

That makes a lot more sense now

Well, it's the same company that produces the Proxy Software that I use...

http://www.winproxy.com/index.asp

(I can imagine it's just like a hardware version of what I have but with more features...)

Regarding Support, I have 3 unique Serials for Winproxy (I'm the IT Manager for 3 companies, which all have seperate LAN's so have their own unique DSL connection) and I've never been able to get any decent support from Otisis, so troubleshooting has been left down to me & the Manual on rainy days!

Come to think about it...I've still not figured out how to get AOE2 working across that thing though. LOL!
It works well for everything else bar gaming. Really well infact.

Anyway, that's enough preaching about Winproxy.. Let me know how you get on, heh.