topic Re: R80.40 Take 120 & VSX - Full HTTPS Inspection issue in Firewall and Security Management

R80.40 Take 120 & VSX - Full HTTPS Inspection issue

Alex- — Wed, 25 Aug 2021 11:22:20 GMT

Upgraded two unrelated VSX clusters to R80.40 Take 120 running full HTTPS inspection, and on each I began to notice choppy behaviour on web browsing, along with web-based applications beginning to fail.

When I switched back to the member still on Take 118, it worked directly. Then issues reappeared after going again to the Take 120 system. I refreshed the VS and pushed the policy but it didn't help. I rolled back to Take 118 and everything is peachy again, although I could have used the myriad of fixes introduced in Take 119. 🙂

On one of these clusters, HTTPSi was in evaluation so I can narrow it down to a couple of PC's and work with TAC, an SR is open.

I will post if I get relevant developments, I just wondered if others are using VSX + Take 120 + HTTPSi and having a similar issue.

Re: R80.40 Take 120 & VSX - Full HTTPS Inspection issue

Naama_Specktor — Wed, 25 Aug 2021 12:11:34 GMT

Hi 🙂

We are not familiar with this issue , I will appreciate getting the SR number for better understanding.

thanks!

Naama Specktor

Re: R80.40 Take 120 & VSX - Full HTTPS Inspection issue

mcatanzaro — Wed, 25 Aug 2021 12:12:31 GMT

There was a rare issue discovered with T119 and T120 that sounds similar to what you are describing.

Are you seeing any parser errors in your logs?

Either way, if you have a TAC case open then you’re on the right path.

Re: R80.40 Take 120 & VSX - Full HTTPS Inspection issue

Alex- — Thu, 26 Aug 2021 07:40:57 GMT

@mcatanzaro There is a bunch of "F2P outbound processing failed (CPAS)", after a session with TAC they hint at SecureXL but additional debug sessions are planned during an upcoming maintenance window.

Re: R80.40 Take 120 & VSX - Full HTTPS Inspection issue

maad-pul — Tue, 22 Mar 2022 18:39:44 GMT

Did you find any solution for this problem?

Re: R80.40 Take 120 & VSX - Full HTTPS Inspection issue

Chris_Atkinson — Tue, 22 Mar 2022 23:51:49 GMT

Are you already running a JHF version that includes the following?

PRJ-30818,
PRHF-19417

SecureXL

In a rare scenario, after an upgrade, HTTPS traffic may be dropped.

Re: R80.40 Take 120 & VSX - Full HTTPS Inspection issue

maad-pul — Wed, 23 Mar 2022 06:04:23 GMT

No, not yet. Take38 not GA for 81.10. I have seen that bug, but it just day HTTPS traffic not HTTPS Inspected traffic. Maybe a typo from CP?

Re: R80.40 Take 120 & VSX - Full HTTPS Inspection issue

Alex- — Wed, 23 Mar 2022 09:19:04 GMT

I left the cluster on R80.40 Take 118 until R81 T44 became recommended and upgraded there and now Take 58, never had any HTTPS Inspection issues since.