topic HTTPS Inspection is always bypassed - "Inspection is not Required" in Firewall and Security Management

HTTPS Inspection is always bypassed - "Inspection is not Required"

Nikolas135096 — Tue, 05 May 2026 15:36:08 GMT

Hi community,

I’m running into an issue with HTTPS Inspection and would appreciate your insights.

I’ve configured HTTPS Inspection to the best of my knowledge:

* HTTPS Inspection is enabled on the firewall
* There is an outbound rule with the action set to **Inspect**
* The inspection certificate is properly installed on the client

However, inspection is never actually triggered. All traffic is consistently marked as **Bypass**, with the reason: *“Inspection is not required.”*

Has anyone encountered this behavior before or knows what could cause this? Are there specific conditions, rulebase settings, or blade interactions that might lead to traffic being skipped with this message?

It's an Open server with R82 Take 91.

Thanks in advance!

Niko

Re: HTTPS Inspection is always bypassed - "Inspection is not Required"

PhoneBoy — Tue, 05 May 2026 16:42:42 GMT

Most likely, this is going to require a TAC case.
I've never seen this message myself and don't see it mentioned in any TAC cases.

Re: HTTPS Inspection is always bypassed - "Inspection is not Required"

the_rock — Tue, 05 May 2026 16:57:25 GMT

Never seen it either...

Re: HTTPS Inspection is always bypassed - "Inspection is not Required"

Nikolas135096 — Wed, 06 May 2026 07:38:23 GMT

Thanks a lot for your fast replies. I'll open a TAC case.

Re: HTTPS Inspection is always bypassed - "Inspection is not Required"

the_rock — Wed, 06 May 2026 11:33:17 GMT

Let us know how it goes.

Re: HTTPS Inspection is always bypassed - "Inspection is not Required"

Bob_Zimmerman — Wed, 06 May 2026 14:22:51 GMT

Do you have a rule which needs to see inside the traffic? For example, are you applying AV scanning?

HTTPS Inspection isn't an end in itself. It's a feature to allow other inspection to work. If there's no other inspection which depends on it, maybe the firewall doesn't insert itself into the TLS negotiation because inspection is not required.

Re: HTTPS Inspection is always bypassed - "Inspection is not Required"

the_rock — Wed, 06 May 2026 14:44:29 GMT

I just ran your screenshot through chatgpt and below iw aht it gave me. Not sure if you can double check these points:

*****************************

This screenshot is from a Check Point log (likely SmartLog / SmartConsole), and it’s showing how a specific connection was handled by your security policy.

Here’s what each field means:

Action: HTTPS Bypass

The traffic matched a rule that bypasses HTTPS inspection.
In plain terms: the firewall did NOT decrypt or inspect the SSL/TLS traffic.

Action Reason: Inspection is not Required

This explains why it was bypassed.
The policy determined that this connection is trusted or excluded, so deep inspection wasn’t necessary.

Policy Management: NK-CP-MGMT

This is the management server that pushed the policy.

Policy Name: IDAwarenessPolicy

The connection matched a rule inside your Identity Awareness policy.
Likely tied to user/group-based rules rather than just IP/port.

Policy Date: Yesterday, 16:51:30

Timestamp of when the policy currently installed on the gateway was applied.

What this means overall

Traffic matched a rule that explicitly says:

“Allow HTTPS traffic without SSL inspection.”

This is commonly done for:

Trusted domains (banking, Microsoft, etc.)
Privacy-sensitive traffic
Applications that break under SSL inspection
Performance optimization

Why this matters

Because it was bypassed:

No SSL decryption happened
No deep threat inspection inside the encrypted payload
Only basic inspection (IP, port, SNI, etc.) was applied

If you’re troubleshooting

This log tells you:

If you expected HTTPS inspection → your rulebase is bypassing it
If something is being missed (e.g., malware detection) → this could be why

Re: HTTPS Inspection is always bypassed - "Inspection is not Required"

Nikolas135096 — Fri, 08 May 2026 11:31:08 GMT

You're absolutely right. As soon as I enabled Threat Prevention, the traffic was inspected. Thank you very much!

Interestingly, even the support team hadn't seen that message before.