Skype access issues in InterScan Web Security Virtual Appliance (IWSVA)

The issue occurs because IWSVA uses multiple threads to work and maintain the connection. This is why the connection times out three minutes after the Skype call starts.

To resolve the issue:

1. Schedule a downtime on your network.
2. Download and install Service Pack 1if you are using IWSVA 5.1.

   Refer to the Installation Guide for upgrade instructions. If you are using version 5.5, 5.6, or 6.0, proceed to the next step.

3. Launch a Command Line Interface (CLI) session to go to the etc/iscan directory.
4. Back up the intscan.ini file which is the main configuration file for IWSVA.
5. Open the intscan.ini file using vi or vim editor.
6. Look for the "TunneledSSLTimeout" key and change its value to "500000000".
7. Save and close the file.
8. Execute the following command to stop and start the IWSVA service:

   /etc/iscan/S99ISproxy stop
   /etc/iscan/S99ISproxy start

9. Perform a test Skype call.

If the issue persists:

1. Configure the log setting to verbose mode. This will generate the needed HTTP logs in a more detailed manner. To modify the settings:
   1. Open a CLI session.
   2. Go to /etc/iscan and open the intscan.ini file using vi or vim.
   3. Go to the [http] section and change the value of "verbose" to "1".
   4. Save and close the file.
   5. Execute the following command to stop and start the IWSVA service:

      /etc/iscan/S99ISproxy stop
      /etc/iscan/S99ISproxy start

   This will start generating the logs in verbose mode from this point on.

2. Launch a packet capture:

   tcpdump -s0 -w /tmp/iwsva.pcap

    

   Tcpdump is the building packet analyzer for Linux command lines.
3. Reproduce the issue by making a Skype call again. Wait for the error to occur.
4. Deactivate the verbose mode:
   1. Go to /etc/iscan and open the intscan.ini using vi or vim.
   2. Change "verbose=1" to "verbose=0".
   3. Restart the IWSVA service using these commands:

      /etc/iscan/S99ISproxy stop
      /etc/iscan/S99ISproxy start

5. Stop the packet capture by hitting Ctrl + C in the box where tcpdump is running.
6. Once the issue has been replicated, collect the following:
   • IWSVA information file
     Go to the management console and click Administration > Support, and then generate a new Information file.
   • tcpdump packet sniff logs (/tmp/iwsva.pcap)
     You can use WinSCP to retrieve this file.
7. Send the files to Trend Micro Technical Support.