Web Access Protection on EEA 6.1.16 affecting browsing for OS X 10.11 (El Capitan) users.

[bbraunstein 27]

Hey Guys,

 

Strange issue developed here today. I have a new user who uses a Macbook Pro with El Capitan installed. I installed EEA 6.1.16 and ERA Agent 6.2.166 on the client computer. After a few days, he reported to me that a random amount of websites fail to load for him, but only when he connected to the Internet via Thunderbolt-to-Ethernet adapter. While he was connected to WiFi, the issue did not exist.

 

I tried all browsers (Safari/Chrome/Firefox) and the issue persisted. I did a tcpdump and it shows all GET requests were successfully loaded, but the actual visuals (HTML/CSS/JS) of the webpages did not load. It was a blank page. The ESET logs also did not show any errors or records of sites being blocked. I even tried swapping the Thunderbolt-to-Ethernet adapter thinking maybe it was just faulty, but nothing changed.

 

It took me most of the morning, but I discovered that the root cause was Web Access Protection on EEA. As soon as I disabled this, the sites loaded up fine. For example, one of the sites was codepen.io 

 

Even though I more or less figured out the root cause, I want to know why this is occurring. I have other OS X users with El Capitan installed and the same versions of EEA and Agent that do not have issues hitting that site. And more confusingly, why would this issue only show itself on the WIRED connection and not WiFi? The WiFi is a different network than my internal LAN, but it's obviously not a firewall issue on the network since after disabling Web Access Protection, the device can access the site. The policies are the same for my OS X users, so it also makes no sense why my other users can hit the site, but not this particular one.

 

More info on the device:

15-inch MacBook Pro with Retina Display

2.5GHz Quad-core Intel Core i7

16GB DDR3L SDRAM

512GB Flash Storage

Intel Iris Pro Graphics

 

Thanks.