We use cookies on our website to ensure we provide you with the best experience on our website. By using our website, you agree to the use of cookies for analytics and personalized content.This website uses cookies. More Information
It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Web Security Gateway

Web Security Agent (WSA) failing to disable or pass traffic with inline/upstream Web Filter or WSG and being internal or remote?

  • Type: Knowledgebase
  • Date changed: 4 years ago
Solution #00007212

Scope: 
This solution applies to the Barracuda Web Filter Agent when in use behind an Inline upstream Web Filter or WSG appliance.

Answer: 
The WSA does a series of connectivity checks to make sure the Web Filter filtering service is available, and network connectivity is confirmed.  
 
After the connectivity tests are completed, the WSA will then check to see if any changes have been made on the Remote Filtering tab.  If changes have been detected, the new settings are pulled and the WSA will re-configure with the new settings.  However, during these connectivity checks, the WSA will search and detect upstream web filters, and if detected the WSA will disable itself normally.   
 
Since the upstream Web Filter test occurs before the ‘WSA configuration sync’ occurs, then if the WSA detects an upstream Web Filter, the ‘WSA configuration sync’ will never have a chance to start.  This is why when a WSA is behind an upstream Web Filter, a configuration sync will not function.
 
If the Appliances Gateway is set incorrectly and is pointing inward (see solution 4234 https://campus.barracuda.com/solution/50160000000HnkXAAS, the traffic will pass differently and could cause improper behavior of the WSA or just a single site issue. Also verify static routes are good if needed.
 
Other items to cause failure with WSA behavior are the Headers in the Advanced> Proxy page for Web filter or for the WSG appliances- WSS portal pages here(Configuration, Gateway, Proxy/Caching page)
Send VIA Header also Cuda_cliip if available
The WSA agent does only disable itself if it does recognize a http header which is set by the web filter in inline mode.
 
Also verify all 3 WSA processes are running from a proper install.
barracudawsa.exe
wsamonitor.exe
wsaservice.exe
 
If a new setup, be sure to reboot the PC for sure once.
If setting GPO also, Please try rebooting a second time also.

Link to This Page: