Firewall blocking - malformed header

[akjn1969]

Apologies if there is an existing thread for this issue.
Our ZOOM search facility is not working for some user accessing our Intranet site.
This is the report the firewall is returning:

Attackzone external
Category protocol_violation
Cmd httpp
Dest Port 80
Dest Zone external
Dst_geo GB
Dst_local_port 80
Event malformed header
Facility http_proxy
Hostname hostname
Information X-Powered-By, ASP.NET
Netsessid 5f67c5368d86b
Protocol tcp
Reason Malformed header, unable to find':'. Session terminated.
Rule Name HTTP Access to External
Source Port 64160
Source Zone internal
Src_local_port 0
Syslog 4
Syslog Warnings (4)
Type attack

Is there anything we need to do when indexing the site or do they need to do anything their end with the firewall settings?
We are using ZOOM 10.6 (Build 1014)

[Ray]

I'm not clear what the situation is. Are you saying a user is accessing your Intranet site from outside your Intranet? e.g. over the Internet?

What is the address they are accessing which invokes this error?

Is this firewall installed on this user's computer? Is this computer within your Intranet or external to it?

Or is this a firewall for your Intranet?

Can they access any other page from your Intranet via the same protocol? i.e. http://123.456.789.1/someotherpage.html ?

[akjn1969]

The site is set up on an Intranet which is accessed over multiple sites. A series of LANS connecting to a WAN.

They can access the rest of the site, but get this message when attempting to use the search facility.

[Ray]

Can they access the search when they disable the firewall temporarily?

Looking up the error message on Google, it seems to be from McAfee Firewall Enterprise.

Here is their knowledge base article on how to address this issue:
https://kc.mcafee.com/corporate/inde...ent&id=KB64283

So a quick fix would be to follow the instructions linked above and add a bypass rule for the search page.

The error message is very lacking however, in telling us what they found to be malformed about the header (or even which header)

The header it is referring to could be something configured on your web server. Are there other .aspx pages on your site?

Or it could also be due to the content of your search.aspx wrapper page (which would have been modified to suit your site's appearance).

[kaufenpreis]

Thank you. Now all ok. Good information form link above.