Internet Access Block Possible IAG Proxy or Policy Issue? 100

Sameena Jameel Lv1Posted Jun-12-2025 22:35

I’ve been using the Sangfor NGAF firewall for some time now, and everything was working fine until this morning. Suddenly, internet access has stopped completely  even basic websites like google.com are not opening. The browser shows a timeout error.
Sangfor is running fine, and all services show normal. I haven’t made any recent policy changes. DNS resolution works from the firewall itself but no client device is able to browse.

Could this be an issue with the Internet Access Gateway (IAG) proxy service or some caching/authentication glitch? Please guide me on what to check next or how to resolve this.
Thanks

Syed ShahMir has solved this question and earned 10 coins.

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins, 100 coins of bounty and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

This issue is most likely related to the **IAG proxy** or an **authentication glitch**. Here's what to check quickly:

1. Make sure **Proxy Service** and **Authentication Service** on the IAG are running.
2. Temporarily **bypass the proxy** for a test client — if the internet works, the problem is with the proxy.
3. Check **NAT and Security policies** on the firewall — something may be blocking client traffic.
4. Look at **logs** (Proxy, Internet Access, and Firewall) for any errors, denials, or authentication failures.

Since DNS works on the firewall but not on clients, it's likely that the issue is with **proxy or client-side authentication**. Try restarting the proxy service and test again.
Is this answer helpful?
AimanHakim Lv2Posted Jun-13-2025 04:08
  
Hi, you can try enable sangfor global passthrough. If everything able to access the internet, then it means sangfor is the culprit. At the same time, an output will generated shows what sangfor did to block if there's any were done.

If no output, means that sangfor is not blocking anything. At the same time, can try troubleshooting via the command line in NGAF. Try access the internet, if it can also means that sangfor may be the culprit. If the NGAF also unable to access, meaning that maybe there's a routing or policy missconfig.

Also u mentioned about an IAG is used. Is there a topology how's ur network design so we can get a better understanding? U can censor the IP's for security ofcourse
Ali Vayani Lv1Posted Jun-13-2025 12:46
  
Hello,
Please try the following steps:
1. Restart the IAG Proxy Service
Navigate to System > Services > Internet Access Gateway.

Confirm the HTTP/HTTPS proxy service is running. If not, restart it.

2. Temporarily Disable Web Filter/Control
Disable the Web Filter and Application Control modules to check if they're causing the block.

3. Test Without Authentication
Create a temporary policy to exclude your device from authentication and see if internet works.

If it does, the issue may be related to IAG token expiration or SSO binding.

4. Check Logs
Go to Log Center > Security Logs and filter by your device IP.

Look for access denied, proxy timeout, or authentication failure entries.

5. Clear Sessions & Cache
Under IAG > Advanced, try clearing session cache or restarting the proxy process.

6. Verify License & Performance
Double-check that your IAG license is active and resource usage (CPU/RAM) isn’t maxed out.
AR Lv2Posted Jun-13-2025 14:23
  
Hello,
Enabling sangfor global passthrough is an option.  If everyone has internet access, then Sangfor is the one at fault.  Simultaneously, an output will be produced that details the actions taken by sangfor to block, if any.

If there is no output, then sangfor is not obstructing anything.  At the same time, you can attempt troubleshooting in NGAF via the command line.  Try using the internet; if it does, sangfor might be the cause.  If the NGAF cannot access either, there may be a routing or policy misconfiguration.

You also noted the use of an IAG.  In order for us to better understand your network design, is there a topology?  Of course, you can block the IPs for security.
Syed ShahMir Lv1Posted Jun-13-2025 15:02
  
This issue is most likely related to the **IAG proxy** or an **authentication glitch**. Here's what to check quickly:

1. Make sure **Proxy Service** and **Authentication Service** on the IAG are running.
2. Temporarily **bypass the proxy** for a test client — if the internet works, the problem is with the proxy.
3. Check **NAT and Security policies** on the firewall — something may be blocking client traffic.
4. Look at **logs** (Proxy, Internet Access, and Firewall) for any errors, denials, or authentication failures.

Since DNS works on the firewall but not on clients, it's likely that the issue is with **proxy or client-side authentication**. Try restarting the proxy service and test again.
mantasha Lv2Posted Jun-14-2025 14:28
  
Hi there,  It is possible to enable sangfor global passthrough.  Sangfor is at blame if everyone has access to the internet.  At the same time, an output detailing the steps that sangfor took to block, if any, will be generated.  Sangfor is not impeding anything if there is no output.  You can also try using the command line to troubleshoot in NGAF at the same time.  Try utilizing the internet; sangfor may be the reason if it does.  A route or policy misconfiguration might be the cause if the NGAF is unable to reach either.  You also mentioned using an IAG.  Is there a topology so we can better comprehend your network design?  For security, you can, of course, ban the IPs.
nushat Lv1Posted Jun-14-2025 15:01
  
An **authentication glitch** or the **IAG proxy** are most likely to blame for this problem.  Here's what you should promptly check:  Verify that the IAG's **Authentication Service** and **Proxy Service** are operational.  
2. For a test client, temporarily **bypass the proxy**; if the internet functions properly, the proxy is the issue.
3. Examine the firewall's **NAT and Security policies**; something might be preventing client traffic.  
4. Check for errors, denials, or authentication issues in the **logs** (Firewall, Internet Access, and Proxy).  The problem is probably with **proxy or client-side authentication** because DNS functions on the firewall but not on clients.  Restart the proxy service and try testing once more.
Doll Lv1Posted Jun-15-2025 04:30
  
Enabling sangfor global passthrough is an option.  If everyone has internet access, then Sangfor is the one at fault.  Simultaneously, an output will be produced that details the actions taken by sangfor to block, if any.

If there is no output, then sangfor is not obstructing anything.  At the same time, you can attempt troubleshooting in NGAF via the command line.  Try using the internet; if it does, sangfor might be the cause.  If the NGAF cannot access either, there may be a routing or policy misconfiguration.

You also noted the use of an IAG.  In order for us to better understand your network design, is there a topology?  Of course, you can block the IPs for security.
Umer Lv1Posted Jun-15-2025 04:38
  
Hi there,  It is possible to enable sangfor global passthrough.  Sangfor is at blame if everyone has access to the internet.  At the same time, an output detailing the steps that sangfor took to block, if any, will be generated.  Sangfor is not impeding anything if there is no output.  You can also try using the command line to troubleshoot in NGAF at the same time.  Try utilizing the internet; sangfor may be the reason if it does.  A route or policy misconfiguration might be the cause if the NGAF is unable to reach either.  You also mentioned using an IAG.  Is there a topology so we can better comprehend your network design?  For security, you can, of course, ban the IPs.

I Can Help:

Change

Moderator on This Board

908
182
94

Started Topics

Followers

Follow

Board Leaders