lan to wan not functioning in EAP3 for devices (roku, tivo, unifi ap's)

Hi,

your rules are set to use the DPI engine. You have web scanning enabled which will probably be the cause of your issue. Have enabled do not scan video and audio steaming?

Ian

Where do I have DPI for Roku/Tivo enabled?  I have web policy Allow All, and nothing else checked.   Should I be checking Use web proxy instead of DPI engine?

Hi,

web policy allow all enables DPI and there is a bug in the current version that enabling none is not effective.

Ian

Hey Ian - I see the same behaviors with web policy allow all or none.  So it sounds like none is the correct value but due to a bug does not work.  So it sounds like I will just need to wait for EAP4 and hope this bug is resolved?  Or am I missing a workaround?  I have added in a ssl/tls inspection rule to not decrypt those devices in the hope this may help, but I doubt this to be the case.

Hey Ian - I see the same behaviors with web policy allow all or none.  So it sounds like none is the correct value but due to a bug does not work.  So it sounds like I will just need to wait for EAP4 and hope this bug is resolved?  Or am I missing a workaround?  I have added in a ssl/tls inspection rule to not decrypt those devices in the hope this may help, but I doubt this to be the case.

Hi Gary,

no just build a firewall rule with only IPS settings, do not add web or application other than defaults. Even then your IPS could cause some issues.

You don't need web scanning whether it be proxy or DPI for steaming functions.

Ian

Hey Ian -  Thanks for the ideas, unfortunately I got the same results.   I am working with Apurv to see what we can come up with.

In order to make v18 behave like v17.5 you need to do the following things:
For any rule that does anything with port 80/443 traffic, select the "Use proxy instead of DPI engine".
Rules that have "Scan HTTP and decrypted HTTPS" and "Use proxy instead of DPI engine" should not have Web Policy None. Change to Allow All. Known issue.

Doing that will cause the v18 box to use the same web proxy as 17.5. If things still don't work, you've got other issues.

Assuming that does resolve the problems, then the next step is switching the rule for your Roku TV back to the DPI mode and then investigating with logs what it is trying to connect to and why it cannot connect.