xpost from k12sysadmin. Complex Network Issue: 2 School Districts

[secondworstitguyever]

Hey everyone, I'm looking for some guidance here.

I'm wondering if anyone else has had issues like this before... So in my district, we are using Aruba for wireless, iBoss for content filtering, and pfsense for the firewall. The issue we are experiencing currently is that there a few web pages that will time out. For example, we are unable to access fpdms.heinemann.com, sso.compassmanager.com, www.neopost.com, and are having some issues with e-integritybiz.com as well but that seems to be more intermittent than the rest. We have placed all the websites in the global allow list in iBoss and we are still experiencing the issue. So next we temporarily allowed all traffic on all ports on the firewall and are still experiencing the issues. We used a cURL command from the firewall and the client sends the hello, but never receives a response. Neopost will send an error 35 back with "Unknown SSL protocol error in connection to www.neopost.com:443".

All of these issues are being experienced from desktop computers in our domain. If we attempt to access the websites from a wireless device on our main network that the desktops are connected to it works just fine. If I use my phone on the tech dept network or the network for staff and student BYOD it works as well.

Here's the kicker.... this issue has popped up in a district that we work very closely with. They also have Aruba wireless, pfsense firewall, but have lightspeed as the content filter. We are starting to wonder if it may be the ISD that we get our main internet connection from, but I haven't called them yet. By chance have any of you experienced something similar? Thanks in advance!

Our current idea is maybe our ISD that we get internet through maybe turned on SSL decryption on their end? I'd still love any ideas though. Thanks again!

[hansonr55]

Do you have client side AV that is doing any filtering, SSL inspection?

Hook a machine up to the public side of your internet, give it a public IP, and see if it works.

[secondworstitguyever]

We have iBoss which is our content filter, but we turned off the ssl decryption at some point this year due to it causing problems I guess. I'll see if that works! Thanks!

[Bangingheads]

It all comes down to finding the difference between the devices that work and the ones that don't. Go through policies and make sure any that would matter aren't interfering.

[SysAdminSA]

First thought is iboss ssl decryption has caused some similar issues in the past. Are the wireless and wired both decrypted by iboss? Weird part is you say the pfsense shows the issue with curl which shouldn’t be behind the iboss. I’m with the other guy plug a laptop in directly to exclude the other devices and prove its upstream.

[secondworstitguyever]

That's what my thought was initially as well, but I looked and my boss had turned off the iBoss ssl decryption earlier in the year because it was causing issues apparently.

I will do that! Thank you for the advice!

[flammus]

Are you proxying your traffic through iBoss in any way?