Version: SGOS 4.1.3.1, build 24075
Release Date: 02/07/2006
Revision: 3.00

This document provides a subset of limitations and known issues with the Blue Coat SGOS 4.1.x release that might be encountered by more than a few customers. It is updated with every SGOS 4.1.x dot release.

Read through the following issues before upgrading to the SGOS 4.1.x release. Also, if an operation issue arises, before contacting Blue Coat, visit this page to verify it is not a limitation or a known issue.

Browsers

• If you are using HTTP to connect to the Management Console, pressing the Back button in the browser results in the following error message:

Unable to obtain session secret from ProxySG. Please try reloading the current page.

Refresh the current page to continue. (B#45351a)

• Netscape 4.x browsers are incapable of handling compressed content for certain content types. For now, it is advised to disable compression for all requests from Netscape 4.x browser. You can use following policy for this (B#46368a):

<proxy>
  request.header.User-Agent="Mozilla/4." request.header.User-Agent=!".MSIE." http.allow_compression(no)

• If you are using Firefox to access one Management Console and open another Firefox browser to access a different ProxySG Management Console, the second browser might not be fully functional. This is a Firefox issue, not one with the Proxy SG (B#48146).
• When running JRE v1.4.1_07, resizing the window does not repaint the browser. To repaint, reselect the applet.

Access Logging

If you change log formats on the fly, the ProxySGcontinues logging to the same log object, resulting in a log upload of a file that contains two different formats. This is a transient condition that affects only a certain number of entries (the number depends on the load) after which the new file is generated with the correct ELFF header. This has the effect of Reporter not reporting that “certain number of entries”.

Authentication

Forms-based authentication is not supported through explicit proxy when a user attempts to visit an HTTPS site.

Bandwidth Management

• There might be transient statistics measurements when changing the priority level of a bandwidth class. (B#483902a)
• Bandwidth Management hierarchy might need to be re-configured when copying the output of show config to reconfigure a ProxySG. (B#50382a, B#51418a)

Branch Deployment

Before deploying ProxySG appliances for branch office acceleration through SOCKS compression, review the following:

• Enable SOCKS Proxy on Concentrator Proxy to compress Outlook/CIFS traffic between Branch Proxies and the Concentrator Proxy.
• Enable HTTP Proxy on Concentrator Proxy to compress HTTP responses Branch Proxies.
• SOCKS Compression and HTTP Compression are CPU and memory-intensive functions.
• Do not use existing Gateway Proxy or Reverse Proxy as a Concentrator Proxy.
• SOCKS Compression and HTTP Compression can be simultaneously active on Concentrator Proxy with certain caveats listed below.
• Do not enable other functions that require large memory allocations on Concentrator Proxy, such as:
• HTTPS termination/origination.
• HTTP decompression.
• Policy for page transforms, response data and apparent data type triggers.
• Do not enable other high CPU intensive applications, such as:
• HTTPS termination/origination.
• Spyware policy.
• Implement Page transforms and Spyware policies on the Gateway Proxy ( not the Concentrator Proxy).
• Implement HTTPS termination/origination on the Reverse Proxy ( not the Concentrator Proxy).
• The same Branch Proxy can be used for SOCKS Compression and other protocols, such as HTTP.
• Blue Coat recommends that the Branch Proxy use the Concentrator Proxy as the HTTP Proxy for forwarding HTTP traffic (not as SOCKS Proxy).
• The ProxySG does not support load balancing across SOCKS gateways.
• To compress Microsoft Outlook traffic, the ProxySG in the branch office must be in line as a bridge. Because of dynamic traffic, you cannot use an L4 switch or a WCCP router to intercept RPC services.
• Verify duplex settings are compatible in bridged deployments (in branch offices).
• Specifying the ports that intercept the CIFS/printing protocol: In a deployment where one group of CIFS/printing services listens on both ports 139 and 445 and another group of CIFS/printing services listens only on port 139, configure the branch ProxySG to only intercept port 139; do not configure to intercept both ports 139 and 445. Otherwise, the port-139-only services will break. This presents the limitation that when clients choose to use port 445, that content is not compressed because 445 traffic is not intercepted.

Bridging

• When a ProxySG is deployed inline as a bridge, it intercepts traffic (such as HTTP Port 80 traffic) from both inside (Intranet) and outside (Internet). This makes the ProxySG an Open Proxy unless it is explicitly configured to deny connections from the outside. If this is not intended, you must create explicit policy rules to only proxy connection from the inside.
• The PCAP bridging filter does not work in software bridge implementation. (B#53918a)

Compression

• The following content types are already recognized by Internet Explorer as compressed. Regardless of the user-agent, these types are not compressed by the ProxySG (B#44032a):

image/gif
image/jpeg
image/png
image/pjpeg
application/x-compressed
application/x-zip-compressed
application/x-gzip-compressed
application/futuresplash
application/x-rtsp-tunnelled
application/x-shockwave-flash

Additionally, the following (standard) content-types are not able to be compressed:

application/zip
application/x-gzip
application/pdf
audio
video

• Blue Coat recommends using gzip encoding (or allowing both gzip and deflate) when using HTTP compression, for the following reasons:
• Servers return deflate-encoded content, but do not return an Accept-encoding : header.
• Deflate is discussed in two standards: RFC1950 and RFC1951. Most servers return RFC1951, while the HTTP/1.1 standard requires RFC1950.
• IIS HTTPZIP plugin (older versions) returns gzip when asked for deflate. (This is treated by SGOS 4.x as an unsolicited response and passed through to the browser).
• IIS HTTPZIP plugin (newer versions) returns gzip when asked for deflate, but claims it is deflate. This appears as corrupt data to browsers and the ProxySG.

HTTPS

• Creating HTTPS services on 255.255.255.255:443 can result in a service that cannot be deleted. This should not prevent the creation of other valid HTTPS services on the same port. (B#50384a)

Instant Messaging

• Video and audio are not supported with any of the Instant Message protocols: MSN, Yahoo!, AOL. (B#52283a, 1-13536917)
• The ProxySg sends alert messages to the user in-band or out-of-band as specified by the configuration variable exceptions. However, alert messages for those IM activities such as file transfer (that use direct connections), are always sent out-of-band. (B#54481a, 1-16108722)
• Connection through SOCKS V5 from a Windows2K desktop might fail when using MSN 7.0. (B#54009)
• IM Proxy creates incorrect accesslog entries for login method for all three IM protocols. (B#54721)

JRE 1.5 (5.0)

• If you experience system slowness issues with JRE 1.5, enter the following command from the (config) prompt:

SGOS#(config) netbios
SGOS#(config netbios) nbstat responder enable

(B#48920a)

• JRE 1.5 on Windows XP; Visual Policy Manager: In the All Objects dialog, when you select New, then a policy layer, an extra, unselectable field appears below Combined Objects.

Passive FTP Exception

For a configuration that uses Passive FTP through SOCKS, the above policy might not avoid the 30-second delay caused by protocol detection. The reason for this is because a separate DATA connection is created to transfer data and the port used on this DATA connection is random, and policy cannot be enforced. If this configuration is necessary, there are two options:

• Generate a white list of FTP servers that can be accessed. For example:
<proxy>
  client.protocol=socks condition=ftp_destination detect_protocol(none)
  define condition ftp_destination
  url.address =   IP_address
  url.address = IP_address
end condition
• Implement policy to disable protocol detection for all SOCKS tunnels. For example:
<proxy>
  client.protocol=socks detect_protocol(none)

Peer to Peer

The following peer-to-peer (P2P) clients cannot connect to the ProxySG using SOCKS V5 authentication (B#45540a):

• eMule Version 0.43b
• KazaaPlus 2.6.4

Policy

• Cutting and pasting of a category does not work as expected. Once policy is installed, the effect of an earlier cut and paste disappears. (B#49036a)
• CPL: When constructing policy, Blue Coat recommends that Forwarding layers be placed after Proxy layers; otherwise, the Forwarding layer might not be evaluated.

• VPM: When creating a time object, if you enable some of the options, the tabbing sequence does not select the newly enabled fields. It simply runs through all the enable checkboxes, through the buttons, and back to the top. For example, if you enable Only Between The Following Times of the Day and tab through all the options, the From and To fields do not get selected. (B#48267a)
• VPM: The progress bar in the Management Console VPM applet is editable, but does not result in any action. (B#48694a)
• VPM: After declaring patience on an object, if the server connection is reset, the object re-fetches and re-scans, causing repeat patience pages.
  50386a
• VPM: Category-URLs should not contain the equal (=) character. If a user enter category=name as part of URLs of a category, it is treated as subcategory. (B#50420a)
• VPM: If a category exists under more than one parent, the generated policy also contains repetitive entries of the same category; this does not present any complications.50424a
  Content Filtering: The test-url command with an embedded '&' might create extra newlines in the output. (B#51298a)

Protocol Detection

A 30-second delay occurs when the ProxySG tunnels any protocol where the server speaks first. Examples of these protocols are FTP, SMTP, POP3, and IMAP. Currently, the ProxySG does not support protocol detection for such protocols; therefore, the delay occurs in all three types of tunnels:

• TCP tunnel
• SOCKS tunnel
• HTTP CONNECT tunnel

The workaround for this is to define policy that disables the protocol detection for all tunnels where the tunneled protocol is the one where the server speaks first. The following is an example of such policy.

<Proxy>
;Rule 1
  condition=server_speaks_first_port_list condition=tunneling_protocol detect_protocol(none)

; Definitions
  define condition server_speaks_first_port_list

  url.port=25
  url.port=143
  url.port=21
  url.port=110
end

define condition tunneling_protocol
  client.protocol=http
  client.protocol=tcp
  client.protocol=socks
end

Notes:

• The destination-based condition in Rule-1 must be included to avoid a security issue.
• If a server is listening on a non-default port, you must add a line in with that port (for this example, in the server_speaks_first_port_list condition).