HTTP Anti-Virus Proxy

I am receiving the following message:

HAVP: Server is down

The following server is down:

salespoint.dealerconnection.com

If you have any queries contact your ICT Co-ordinator or Network Manager.

Endian Firewall - Powered by HAVP

.........

This occurs when trying to browse to http://salespoint.dealerconnection.com

I have disabled Antivirus option on the Proxy page in Endian Firewall and can then browse the page without error.

Can anyone help with this problem. What can I do to resolve this issue. I have a PC running latest community release of Endian Firewall with AntiVirus enabled and 27 client PCs running XP Pro and IE 6.x

So what version of HAVP is used? Can you find anything from HAVP logs?

This could be anything, bad connection, MTU problem, old HAVP version..

Cheers,
Henrik

reviewing......

/var/log/havp/havp.log

22/10/2006 23:08:24 (127.0.0.1) Could not read browser header
22/10/2006 23:08:26 (127.0.0.1) Could not read browser header
22/10/2006 23:08:32 (127.0.0.1) Could not read server header (salespoint.dealerconnection.com:80)
22/10/2006 23:08:33 (127.0.0.1) Could not read server header (salespoint.dealerconnection.com:80)
22/10/2006 23:11:25 (127.0.0.1) Could not read server header (salespoint.dealerconnection.com:80)
22/10/2006 23:11:26 (127.0.0.1) Could not read server header (salespoint.dealerconnection.com:80)
22/10/2006 23:12:03 === Starting HAVP Version: 0.81
22/10/2006 23:12:03 Change to user clamav
22/10/2006 23:12:03 Change to group clamav
22/10/2006 23:12:03 Use parent proxy: 127.0.0.1 8080
22/10/2006 23:12:03 --- Initializing ClamAV Library Scanner
22/10/2006 23:12:03 ClamAV: Using database directory: /usr/share/clamav
22/10/2006 23:12:05 ClamAV: Loaded 74090 signatures (engine 0.88.3)
22/10/2006 23:12:05 ClamAV Library Scanner passed EICAR virus test (Eicar-Test-Signature)
22/10/2006 23:12:05 --- All scanners initialized
22/10/2006 23:12:05 Process ID: 23907

-----------------------

As far as it being a bad connection, I would think this is not the case. I have two firewalls with same Endian 2.0 Respin distro loaded. One here at home and one at work. Both are giving the same error. The one at work is a dedicated fiber to ethernet connection via a 10/100/1000Mbps NIC.

If I disable the Antivirus checkbox on the Proxy admin page on EndianFW, users are able to browse the http://salespoint.dealerconnection.com site just fine.

If you have any suggestions we could try, I can take the home firewall and attempt installing newer ver of HAVP or making any other changes you might suggest. The home box isn't mission critical, but I REALLY need the one at work going soon.

Thanks for the reply!

It could be fixed already in 0.83, but I don't know how to upgrade it in efw. You could post a bug report (http://bugs.endian.it/) to make developers do it for you.

You could also modify squid.conf (in /var/efw/proxy ?) to bypass that page.

acl no_havp dstdomain .dealerconnection.com
cache_peer_access 127.0.0.1 deny no_havp
(I assume there is cache_peer 127.0.0.1 for havp...)

Cheers,
Henrik

I tested. It's bug in 0.81, which is already fixed in newer versions..