About bwsaloum

Due to the constraints placed on us by management, we don't support Chrome, and early on, I created a custom app ID specifically for Chrome and was able to block it fairly effectively.  Then MS released Edge, which fouled everything up.  So all of the chrome blocks had to be changed allows, so edge would work.  So, like an idiot, I thought I could simply follow the same process, by creating an edge specific custom app ID and went through the entire process, only to be told that my match criteria is invalid.  Tried a couple of different ways, to be honest, but either the pattern was too short, as it requires a minimum of 7 characters (seriously?), which sucks for edg/whatever version #, or it complains about an invalid pattern, when I include Edg/88., which meets the bare minimum 7 character limit.  It also complains when I insert the entire string for Edge (Edg/88.0.705.63).  I really need to find a solution for this.  Has anybody else run into a situation like this? ... View more

Given all of the hurdles one has to go to to get a stand alone device converted to FIPS-CC, I'm told I have to do this on a cluster, so needless to say my anxiety is a bit on the "through the roof" side. Maybe I'm not looking hard enough, but I'm unable to find the steps for an active/passive cluster.  I'm assuming someone has already done this, so are there any pitfalls or gotcha's I need to look out for?   Thank you in advance!   bws ... View more

I dunno if anybody else has run across this or not but I just felt compared to share.  I have been having fairly continious performance problems with a 5050 cluster and last night I isolated at least one culprit that's been adding to that problem.  We are in the process of rolling out Windows 10 and a bunch of new Microsoft apps AND our firewalls decrypt the vast majority of our outbound traffic.  As of late I've been getting all kinds of complaints about browsing the web, pages can't be displayed or it takes multiple refreshes to get content to appear and the list goes on and on.  After staring at the raw traffic logs for hours and after generating a couple of reports to show my top accessed web sites, traffic going to watson.telemetry.microsoft.com was the top site by several orders of magnatitude. Over the course of 24 hours, I had several thousand machines hitting that site to the tune of a half a million times.  My top 25 "hit" parade had traffic to that site alone actually being more than the rest of the 25 combined.  All of it was being decrypted.  When I threw that fqdn into a bypass group the utilization dropped by almost 45% initially.  Now I'm seeing closer percentages of just over half. I used to see substaned cpu utilization averaging between 60 and 70% with gusts to 100, now everything is around 35% with the occasional peak in the low 70's.  Learn from my fail.   Thanks a LOT Microsoft! ... View more

Shortly, after the APP-ID changes were implemented, I'm having problems with youtube.  By default we disable general access to youtube.  However, we do allow access to specific videos.  When I attempt to connect to youtube.com using http, I get blocked properly.  But when I go to it using https. I pretty much have free run, and when I review the logs, https access to yourtube is catagorized as google-base, instead of youtube-base.  Anybody else run into something like that?     ... View more