Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3071
  • Last Modified:

Blue Coat preventing download "Your Request was categorized by Blue Coat Web Filter as 'pending'"

Hello EE,

I have a user who in the past has been able to download this software we require for business production, but after the vendor made a web site redeployment we get the following when trying to download

ICAP Error
Your request was categorized by Blue Coat Web Filter as 'pending'
If you wish to question or dispute this result, please click here.

I submitted a dispute but am wondering can I do anything in my proxy to allow this through or do I need Blue Coat to actually do something?  I am a bit uncertain of how this works exactly.
0
operationsIT
Asked:
operationsIT
  • 2
1 Solution
 
btanExec ConsultantCommented:
I saw that there is similar post (ID: 28486759) from you also, I shared the redirect for review for unrated url. Seems like in this post there is more info and to allow this while waiting for the site review returns, you may check out the below kb

Taking example to allow download based on request to specific url
https://kb.bluecoat.com/index?page=content&id=KB5115

How to use policy to prevent/block downloading of certain file types
https://kb.bluecoat.com/index?page=content&id=FAQ1971

There is even means to allow or deny based on file size (determined by HTTP field such as Content-Length)
https://kb.bluecoat.com/index?page=content&id=KB5133

Strangely, there is a close use case as you are experiencing. For example, if the unrated URL  is not categorized in the BCWF database, it is sent to WebPulse/DRTR for categorization. And in the midst if there is the same URL but appended with path and requesting an image file, which DRTR cannot analyze. Rather than waste time trying to download and analyze the image file (even if it is nonexistent) WebPulse simply returns a category of none.
https://kb.bluecoat.com/index?page=content&id=KB3002

For info, there is policy allowing access to sites even though category blocked - note that this pertains to policy logic where the Web Application rules override any Content Policy rules.
https://kb.bluecoat.com/index?page=content&id=KB5039
0
 
gheistCommented:
So click there and contact bluecoat...
0
 
btanExec ConsultantCommented:
in its own doing, this is actually "default" doing per se but it stated for first time

https://kb.bluecoat.com/index?page=content&id=KB3816

The "Pending" category will appear in the ProxySG logs when running DRTR or WebPulse in background mode.  By running in the background, the proxy administrator is essentially telling the ProxySG that they are unwilling to wait for a response from DRTR no matter how quick the response actually is.  As a result, the logging module needs to put something in the logs and as a result "Pending" is logged and the request is sent to DRTR (or WebPulse).  At that point the ProxySG has already moved on, but it is still listening for the response from DRTR.  When the response is received it is cached and subsequent requests to that URL are categorized from the DRTR cache on the proxy.  So when DRTR is configured in background mode, it is expected to see "Pending" the first time you visit any site that is not rated in the database regardless of how good DRTR will be at categorizing the content.
It suggested below.
3.)  In the Dynamic Categorization section, make sure that "Perform dynamic categorization" is checked.  
4.)  If "In the background" is selected, change the configuration to "Immediately"

and also "Exempt a Specific Domain From Content Filter Policy Check"
https://bto.bluecoat.com/sgos/ThreatPulse/ThreatPulseSolutionsWebGuide/Content/03Solutions/ManageContentFilter/pol_allow_CFdestURL_ta.htm
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now