SSL SA4000 Application error message WB-2 when passing traffic thru rewriter

[jhagdak_]

We are getting the error message below when we try to perform a function (search query) from within our proprietary application. The error does not happen all the time and no log entries are present indicating that any of our policies are blocking this content from displaying. We are passing the app content thru the rewriter and have had no other issues.

Our developers are trying to make some changes on the backend to the app, since they feel this problem only happens when someone experiences latency when doing the query.

Since the error does not happen frequently or sometimes at all for long durations of time it has been difficult to review what exactly is happening to cause this message to occur. I have looked at the Juniper Knowledge base, opened a case with Juniper and searched the Internet to no avail.

Has anyone else ever seen this error before ?

Error WB-2

Cannot access the Web Page. Please notify your systems admin.

[cbarcellos_]

jhagdak,

Can you message me your case number? I can make sure that the case is properly handled for you.

Have you tried pass through proxy (PTP)? Does this issue ever occur when going direct to the site? (You could test this by having specific users use Network Connect (NC). It almost looks like a time out issue becasuse the back end site didnt respond.

[jhagdak_]

Hello, The Case # is 2010-0201-0701

I have not tried PTP since this error is not occurring often and they are not having any other issues within the app.

When I spoke with the Juniper case owner they were not sure if this was even a Juniper message and were not able to let me know what exactly a WB-2 error is. If I knew what this error meant at least I would know what and where to look for any possible solutions. Whatever you can do to assist me on this would be appreciated.

Thanks,

John

[jhagdak_]

Also, The developers have tested this going direct (via our LAN) and have not seen the issue happen but then again it has only happened a few times anyway and would be hard to determine since the problem is sporadic.

This app is strictly web based and we will not be using NC,JSAM,WSAM or PTP to proxy any of the content.

[cbarcellos_]

Just to note: PTP isn't a different access method, it is merely a less intense rewriter. It is not less secure, and does not require a separate client to be installed.

We would need more information about the issue. You can setup a session record by going to (Maintenance --> Troubleshooting --> User Sessions --> Session Record)

On that page you'll need to type in the username and the realm, leave all of the boxes checked. You'd need to get the user configured for session recording to replicate the issue, and then download the log.

The logs created would give us a better idea as to what the rewriter was doing. The dsrecord log shows the web content pre and post rewritring, along with time stamps. So if it is a problem with the back end site simply timing out, it would be visible in the log.

I sent a note to the case owner about your case with these comments as well. Once you get this log to the case owner they should have what they need to did deeper into the issue.

[jhagdak_]

I know how the IVE works and the methods of collecting data from it, however the issue is not happening continuously and turning on Policy Traceing or Packet capture will eventually timeout since it cannot be turned on for extended periods of time.

I was just told to create a Custom Header Policy for this issue and see if this helps our situation.I have been given a vague answer as to what WB-2 actually means, and no documantation of this error was sent to me at this time.

[jhagdak_]

This comes up when the rewrite engine is unable to read the headers.

Was informed I needed to create a Custom Header policy to alleviate this problem.

I am in the wait and see phase now.

More testing needs to be done and will update outcome when available.

[jhagdak_]

After applying this "Custom Header" policy we have not seen this issue any further in our testing.

[JasonP_]

Can you give a few more details about the custom header they asked you to create? We are experiencing the same problems when uploading large files to a redirected link, and it seems like the exact same issue based on the errors we get from the IE/Firefox side. Oddly enough a trace does not seem to say what is happening.

Any info would be greatly appreciated.

[jhagdak_]

No Problem !

Open the Customize button and checked off the "Custom Headers" option to add this feature to the IVE menu.

We applied the resource https://<resource name>:*/* and allowed custom headers for this particuliar resource.

The developers have not had any issues with this application since applying this policy.