WSE0020001 illegal header format detected: Illegal start line in request

[atomicsushi]

Hi,

Does anyone know the fix to this:

Re: [FW-1] https and Squid

I'm seeing the same problem where it's dropping on port 3128.

Number: 2990279
Date: 24Oct2007
Time: 10:24:10
Product: SmartDefense
Interface: eth-s1p1c0
Origin: FWA
Type: Log
Action: Reject
Protocol: tcp
Service: tcp_3128 (3128)
Source: host_10.9.1.23 (10.9.1.23 )
Destination: host_20.0.1.237 (20.0.1.237)
Source Port: 34676
Attack Name: Malformed HTTP
Attack Information: WSE0020001 illegal header format detected: Illegal start line in request
Information: reason: €g^A^C^A

I have HTTP protection Inspection all unchecked.

Does anyone know the fix?

[mc_rockz]

Hi,
What version of Checkpoint are you using? Because i encountered this type of error msg in my NGX R62 distributed setup, i just de-activate "ASCII only Response Header" save then push the policy.


Best Regards,
mc_rockz

[BrianBilbrey]

Anything further on this topic - I am running into the same issue, and though I set what seemed to be the appropriate SmartDefence protection to Monitor Only, it still resets https connections to the squid proxy box. HTTP - no problem.

thanks in advance,

.brian