This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web Filter XG v18 | Scan HTTP and decrypted HTTPS option is relevant

FormerMember over 4 years ago

After testing the proxy options in XG v18 in web proxy and DPI modes, I noticed that Scan HTTP and decrypted HTTPS checked or unchecked has the same effect. I did a test as follows. Disable all proxy options, I disabled SSL / TLS rules and deselected the DPI engine. I made a police custom with category that contains only http sites, I selected this police in the rule and as a result the site was blocked without me selecting any proxy options.

I apologize for my poor English.

This thread was automatically locked due to age.

0 FormerMember over 4 years ago

note: This also happens with https site
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 4 years ago in reply to FormerMember

Please post a copy of the testing rule.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to rfcat_vk
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 4 years ago in reply to FormerMember

That will use the dpi engine, also please post the rest of the rule.

ian
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to rfcat_vk

the dpi is disabled so the firewall will work with the common proxy scanning only http, but the question is not to activate the option Scan HTTP and HTTPS decrypted
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to FormerMember

the rule complete:
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to FormerMember

Categories so_siteshttp

Web Filter Police
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 4 years ago in reply to FormerMember

Your web policy is set to block access.
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to rfcat_vk

Yes, this blocking is just what I want to do. The question would not be this but the use of the option Verify HTTP and HTTPS decrypted, to be unchecked and checked there is no difference, be it blocks or allowed.
From the tests I did I saw that the redirection is done on the 8090, a captive portal is necessary in the destination zone, in my case is LAN. The only plausible reason for is that this option HTTP and HTTPS decrypted is flaged is forces the traffic to be scanned.

I just want to confirm that this is really so.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to FormerMember

XG essentially does not separate between HTTP and HTTPs, as most adminstrators do not care, they want to block the Website / content no matter what protocol.

If you do not want this, you should not use Port 80 or Port 443 in the firewall to begin with.
Cancel
Vote Up 0 Vote Down

Cancel