topic Re: R82 outbound ssl inspection - custom applications are not working in Firewall and Security Management

R82 outbound ssl inspection - custom applications are not working

Daniel_Hainich — Mon, 16 Sep 2024 13:13:47 GMT

hi,

within R82 i couldnt bypass any custom-applications. only categories are working in my lab.

any ideas?

daniel

Re: R82 outbound ssl inspection - custom applications are not working

the_rock — Mon, 16 Sep 2024 14:46:19 GMT

Hey Daniel,

I saw what you showed me via zoom remote session and indeed that is the case. Since I had to delete my R82 lab to do something else, let me try re-create it again and test. Will keep you posted.

Andy

Re: R82 outbound ssl inspection - custom applications are not working

the_rock — Mon, 16 Sep 2024 21:27:03 GMT

Hey Daniel,

Just tested in R82 lab with *heise* and worked fine, was not inspected, but rather bypassed, as it should have been. I did not add any additional categories.

Andy

Re: R82 outbound ssl inspection - custom applications are not working

Daniel_Hainich — Tue, 17 Sep 2024 12:17:17 GMT

i killed my lab and build it from scratch. 1 win11, 1x R82 SMS and GW on one machine. its the same behaviour.

i activated urlf,appi,anti-bot and anti-virus blades. https is setup with CP generated certificate.

my lab is setup with pnetlab/eve-ng but this should not be the problem - or?

it looks like the application is not recognized as custom application and thats why the bypass rule isnt matching.

Re: R82 outbound ssl inspection - custom applications are not working

the_rock — Tue, 17 Sep 2024 12:17:51 GMT

Really odd, thats what I used as well, eve-ng. Only difference compared to before was I used vmxnet NIC type, other than 1000e, but Im positive that would not matter.

Andy

Re: R82 outbound ssl inspection - custom applications are not working

Daniel_Hainich — Tue, 17 Sep 2024 12:53:15 GMT

i changed nic to vmxnet3. but it is the same.

Re: R82 outbound ssl inspection - custom applications are not working

the_rock — Tue, 17 Sep 2024 12:55:49 GMT

Weird...now it shows its inspecting business/economy category. Did you bypass those?

Andy

Re: R82 outbound ssl inspection - custom applications are not working

Daniel_Hainich — Tue, 17 Sep 2024 14:07:20 GMT

when i bypass those categories than it works. but this site is not categorized as custom... i tried it also with other sites. always the same.

iam running on trial lic - can this be the problem?

Re: R82 outbound ssl inspection - custom applications are not working

the_rock — Tue, 17 Sep 2024 14:08:55 GMT

Hm, now that I think about it...MAYBE. Send me the IP address of the gw, I can send you an eval.

Andy

Re: R82 outbound ssl inspection - custom applications are not working

Daniel_Hainich — Tue, 17 Sep 2024 14:28:21 GMT

192.168.1.250

Re: R82 outbound ssl inspection - custom applications are not working

the_rock — Tue, 17 Sep 2024 14:37:21 GMT

Emailed you the info directly.

Andy

Re: R82 outbound ssl inspection - custom applications are not working

the_rock — Tue, 17 Sep 2024 15:37:07 GMT

Hey mate,

Let me know if eval worked for you. If not, lets do remote like yesterday. I got time later on. I know its after hours in Germany now, but if you are around, not an issue.

Andy

Re: R82 outbound ssl inspection - custom applications are not working

Daniel_Hainich — Thu, 19 Sep 2024 11:39:34 GMT

hi andy, your lic was not working. the sms part was missing so i couldnt install policy. i created a new lic and the system is now fully licensed. but it is not working.

i wiped my pnetlab installation and rebuild it from scratch with eve-ng community edition. it is working out of the box with trial lic.

i setup the sms and gw the same way before with pnetlab. this is really strange. i cant understand whats the difference between both tools. @the_rock

Re: R82 outbound ssl inspection - custom applications are not working

the_rock — Thu, 19 Sep 2024 11:42:37 GMT

Right, license failed as I generated it for the gateway, sorry, I remembered just now. Btw, I cant tell the difference, but in my lab, I did EXACTLY the same thing as in R81.20 and worked fine.

Can we do another remote?

Andy

Re: R82 outbound ssl inspection - custom applications are not working

Daniel_Hainich — Thu, 19 Sep 2024 11:46:55 GMT

we can do another remote, but its working now and i did the same as you and in the other configurations before. the only change is the base from pnetlab to eve-ng - whats basically are the same...

Re: R82 outbound ssl inspection - custom applications are not working

the_rock — Thu, 19 Sep 2024 11:48:03 GMT

I misunderstood, okay...if thats the case, glad it works, no need for remote. Im really sorry mate, I dont have a logical answer as to why it did not work before, apologies.

Andy

Re: R82 outbound ssl inspection - custom applications are not working

Daniel_Hainich — Mon, 23 Sep 2024 12:51:15 GMT

i forgot to install the T40 Hotfix. now its running fine on pnetlab and all is working

Re: R82 outbound ssl inspection - custom applications are not working

the_rock — Mon, 23 Sep 2024 12:53:58 GMT

I would still test it with jumbo 40, make sure it works.

Andy