topic HTTPS Inspection of Traffic Flow - HTTPS, FIREWALL AND IPS in Firewall and Security Management

HTTPS Inspection of Traffic Flow - HTTPS, FIREWALL AND IPS

keydee — Sat, 21 Dec 2019 12:51:10 GMT

We have enabled HTTPS inspection covering IPS, IDS, antibot and antivirus. What should be appearing first on the traffic rule in the firewall. Because I normally see https inspection then firewall then IDS. Could you kindly provide an idea on how to carefully analyze these. Which blade should be first appearing on the traffic thats my concern.

Re: HTTPS Inspection of Traffic Flow - HTTPS, FIREWALL AND IPS

PhoneBoy — Sat, 21 Dec 2019 20:18:13 GMT

In general you can expect Access Control logs (firewall, VPN, App Control, URL Filtering) to come up before Threat Prevention logs.
HTTPS Inspection may be required before either Access Control or Threat Prevention makes sense, so these logs may appear before the others.
There are circumstances where it might vary from this slightly.
If you have a specific concern, a concrete example from your logs would be helpful.

Re: HTTPS Inspection of Traffic Flow - HTTPS, FIREWALL AND IPS

HeikoAnkenbrand — Sat, 21 Dec 2019 21:13:09 GMT

Picture is from Slides in article: HTTPS Inspection Best Practices TechTalk: Video, Slides, and Q&A

PS: Log entries should appear in a similar order.