Hi everyone,
I've been evaluating Sophos XGS for a potential deployment to consolidate some perimeter security, and I've hit a snag during my lab testing that I wanted to run by the community.
I have a few older, internally-developed applications that communicate over HTTP (yes, I know—migration to internal TLS is on the roadmap). When I enable the full HTTP inspection features in the Web Protection policy, these apps start timing out or throwing connection reset errors. Disabling inspection for their specific IPs works, but that's not a great long-term security posture.
Has anyone else run into this? I'm trying to pinpoint if it's:
* Something in the default inspection profile being too strict (maybe certain headers?).
* An issue with how the appliance handles HTTP/1.0 vs HTTP/1.1 for these older services.
* A need for a specific exception type beyond a simple IP bypass.
For context, the apps are Java-based and use some legacy Apache HttpClient libraries. A packet capture shows the TCP handshake completes, but the application layer seems to get stuck.
I'd be grateful for any insights or configuration snippets that have worked for others. My next step is to try and build a custom inspection profile, but I'd love to hear if there's a known checklist for this kind of legacy app compatibility.
-- Amy
Cloud cost nerd. No, I don't use Reserved Instances.
Oh, I've seen this exact thing in our lab. We had an old Tomcat app that would just hang with full inspection on.
For us, it was the "Send Expect Continue header" option in the inspection profile. The legacy HttpClient library didn't handle the "100 Continue" response properly and would wait forever. Unchecking that box for a test policy worked as a temporary fix.
Maybe try that? It's under the advanced options in the HTTP profile. I'd be curious if it helps your case too!