Trying to understand SSL/TLS inspection exclusions

Hi pablol :  XG Firewall provides a default exclusion rule "Exclusions by website or category" that prevents connections to certain websites from being decrypted. The exclusion rule contains  "Local TLS exclusion list" The list is empty by default. You can add websites to this list by troubleshooting in the Control center or Log viewer.

To edit this list, go to Web > URL groups and edit the group Local TLS exclusion list. 

Reference : https://docs.sophos.com/nsg/sophos-firewall/18.0/releasenotes/en-us/nsg/sfos/releasenotes/rn_SSLTLSInspectionRules.html

Apart from this, exception created in Web > Exceptions is applicable to both Web Proxy and DPI mode. 

So if you have required domains/IP you may import it in custom category as well via acceptable formats or from external database to make your task easier to add that category in web exception.

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/tasks/WebCategoryAdd.html

Thank you for your response.

I have noticed with my problem with Webex that it does not work when it is trying to connect to an IP. For instance, lets check the entry of  one of my logs:

If I do a reverse lookup on that IP, I get:

Just because I wanted to try, I added amazonaws.com to the local exclusion:

Yet, I keep getting errors.

If I add an exclude as suggested by the log, it adds an IP... there are tens of different ips (if not more) that point to amazonaws.com...

Same issue with webex

This is one of the main problems of IoT and webapp development. 

XG will use the DNS, the app is calling and use this as a exclusion.

We could check in the ips.log on CLI, which IP actually is called by the App and add this.

Personally, i saw different approaches. Big companies uses https://IPs:443 or https://someamazondns.com etc. 

That can become messy, if the company of your apps does not clearly document their domains. 

Try to add those URLs as well: https://help.webex.com/en-us/m0jby2/Configure-a-List-of-Allowed-Domains-to-Access-Cisco-Webex-Teams-While-on-Your-Corporate-Network

This is one of the main problems of IoT and webapp development. 

XG will use the DNS, the app is calling and use this as a exclusion.

We could check in the ips.log on CLI, which IP actually is called by the App and add this.

Personally, i saw different approaches. Big companies uses https://IPs:443 or https://someamazondns.com etc. 

That can become messy, if the company of your apps does not clearly document their domains. 

Try to add those URLs as well: https://help.webex.com/en-us/m0jby2/Configure-a-List-of-Allowed-Domains-to-Access-Cisco-Webex-Teams-While-on-Your-Corporate-Network

Thank you LuCar,

I thought adding webex.com would add every subdomain, is that not the case? I have an exception for webex:

And if I try a webex connection, everything on the log that has those domains are getting passed without decryption. But then I have a bunch of IP's (no domain name, just raw IP's) that are being decrypted. If I do reverse DNS on those IP's I see they are on the webex.com domain.

Same as with aws...

To me it sounds like XG is not doing reverse dns lookup to figure out if a given IP is owned by the list of domains that are exempted. Is this a true statement?

As with ips.log, I am trying to figure out the contents. Will write back once they make sense to me. Or if you have any suggestion I would appreciate.

Meanwhile, I will try and add iot.us-west-2.amazonaws.com to the exception list and see what happens...

Thank you

XG is not doing a reverse DNS. That would take to long for each request to do.

You have only one packet timeframe to decide, if you decrypt or not. Its the TLS Syn packet (first in the handshake). If we would do a reverse lookup, this will likely timeout. So we are using the current called IP or DNS. 

If the client calls something like domain.webex.com, this will hit the exclusion. 

If the client calls something like 1.2.3.4, your exclusion will not hit. (This is bad design by the app, but some apps do this).

If the clients calls a DNS from aws, it depends how this is build. Because in the end, you will call AWS, but the client could call something like test1.com. 

That makes sense...

I think both webex in this specific case and this other appliance calling aws are doing so by IP address.

And as far as I see, my option is to add every IP to the list, or do an exclusion from source IP. For the appliance calling AWS that should be easy to do as it is a static IP and I trust the appliance (It is a security device that only runs that application)

But as for Webex I am at odds... we have another call today. I am implementing the article you sent me and I will check if it works with it.

I guess SNI is what should have the domain name instead of the IP to hit:

I will file a ticket to the company's appliance...

Thank you for all your assistance.