Hey, Jim - Transparent or Standard?  'Decrypt and scan' HTTPS or just 'URL filtering only'?

Cheers - Bob

Hi Bob,

Currently transparent using decrypt and scan HTTPS.

Thanks,

Jim

Jim, what does a line from the Web Filtering log look like when an exe is let through on HTTPS?

Cheers - Bob

Hi Bob,

There is nothing logged regardless of it blocking or passing a exe file. I downloaded ccleaner.exe, HTTP blocked, HTTS downloaded. No web filter logging.......

Thanks,

Jim

That means the access isn't going through Web Filtering, Jim.

Cheers - Bob

Bob,

Clearly I must have missed something.... If extensions are blocked on HTTP the proxy is doing some filtering. Is there a seperate setting to enable it on HTTPS? Catagories are bloced on HTTPS.

Thanks,

Jim

Bob,

I realized that I selected Decrypt and scan the following so catagories could be blocked as opposed to just decrypt and scan. Is this setting the likely cause of no HTTPS extension blocking?

Thanks,

Jim

Hi Bob, hi Jim,

I have the same problem, we use Sophos UTM9 release 9.408-4. In 'Web Protection' -> 'Webfilter' in the third tab 'Policies' we have a profile defined. When you edit the filteractions in the third tab 'Downloads' there is a part 'Blocked extensions' where .exe and some other extensions are defined.

This works well on http sites but definetly not on https sites.

Is it a setting in 'Web Protection' -> 'Webfilter' on the tab 'HTTPS' that I have missed to configure?

thanks

Eva 

Could be, Jim - what happens if you add the category of the .exe URL that was allowed?  What happens if you don't limit to categories?

Hi, Eva, and welcome to the UTM Community!  Please post a picture of the HTTPS tab.

Cheers - Bob

Hi Bob,

It blocked the site, see below. However why does it say the file extension is blocked? The site I used is https://download.piriform.com/ccsetup535.exe and calssified as hardware/software. The message does not correspond to the actual activity. Possibly something is incorectly configured? Please see screen captures below. Once I removed the catagory I now have the same problem. Thanks, Jim

Hi Bob,

It blocked the site, see below. However why does it say the file extension is blocked? The site I used is https://download.piriform.com/ccsetup535.exe and calssified as hardware/software. The message does not correspond to the actual activity. Possibly something is incorectly configured? Please see screen captures below. Once I removed the catagory I now have the same problem. Thanks, Jim

So, are you saying that it's now working as you expected, Jim?

Cheers - Bob

Hi Bob,

I don't think it is working as expected. However I did not have antivirus enabled. Although I did enable it in addition to scanning PUA's the UTM still does not block file extensions on uncatagorized HTTPS web sites. Does antivirus need to be enable for extension blocking to work? For some reason I expected it to work the same as HTTP downloading. Some how I suspect this is a configuration error....

Thanks,

Jim

"Uncategorized" is a trick, Jim.  One is a category and the other is the lack of categorization.

Cheers - Bob

Bob,

Thank you for your help! To be clear then I should configure as a white/black list condition? This explains why I hwas able to block ccleaner.exe the other night.

Thanks,

Jim