Advertisement

08.28.2008 at 10:39PM PDT, ID: 23687980 | Points: 500
[x]
Attachment Details

Get WSE0020001 illegal header format detected with https service

Asked by ernie1976tw in Checkpoint Firewall, Networking Hardware Firewalls, Enterprise Firewalls

Tags: , ,

Hi All
  I create a rule working with service "HTTP" and "HTTPs". Web Server configuration are below.

1.the Operation System with "x86Linux".
2.Application Engines with "General".
3.ports configurations check the "Server uses Standard Port:80",and add 443 in "Server uses additional ports".
4.I also check all default web intelligence protections.
5.My checkpoint is NGX R65 SecurePlatform "2.6"

 My problem is when I access my web with HTTPs,firewall reject my normal access with the log "WSE0020001 illegal header format detected"

The log like:
Destination:                      MY WEB IP
Number:                            38009
Date:                                28Aug2008
Time:                                17:26:11
Product:                             SmartDefense
Interface:                           eth2
Origin:                              PCCPR65
Type:                                Log
Action:                              Reject
Protocol:                            tcp
Service:                             https (443)
Source:                              NCICNET-NET-104-client-ADSL
Source Port:                      1350
Attack:                         Malformed HTTP
Reason:                            WSE0020001 illegal header format detected: Illegal start line in request €L^A^C
Reject ID:                          48b66f33-2-fefe1fac-7b6
Resource:                         Unknown
SmartDefense Profile:            Default_Protection
Policy Info:                        Policy Name: Standard
                                       Created at: Thu Aug 28 17:24:44 2008
                                         Installed from: PCCPR65

Do you have any idea?

Thanks and regards,
ERNIEStart Free Trial
Attachments:
 
WEB CONFIG1
WEB CONFIG1
 
 
web intelligence protections
web intelligence protections
 
 
access deny log
access deny log
 
[+][-]08.29.2008 at 05:17PM PDT, ID: 22349991

Experts Exchange has a courteous staff of administrators who help members get the most out of the website by means of administrative comments like this one.

Start your 7-day free trial to view this Administrative Comment or ask the Experts your question.

 
[+][-]08.30.2008 at 02:03AM PDT, ID: 22351150

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]08.30.2008 at 07:41PM PDT, ID: 22353930

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]09.02.2008 at 01:53AM PDT, ID: 22365257

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628