topic Re: HTTPS inspection policy doubt in Firewall and Security Management

HTTPS inspection policy doubt

Chou_YiHsien — Fri, 11 Sep 2020 06:46:23 GMT

Hi Everyone,

I have a question.

I set 2 policies on R80.40 HTTPS inspection.

1.src:any ,dst:google service , service port:443

2.src:any , dst:xx.xx.xx.xx , service port:443

Why is there no effect if the IP is placed in the second policy?
If you put the IP in the first one, it will be applied normally?

Re: HTTPS inspection policy doubt

_Val_ — Fri, 11 Sep 2020 09:25:40 GMT

How do you mean, no effect?

Re: HTTPS inspection policy doubt

Nikolai_Borhart — Fri, 11 Sep 2020 10:45:34 GMT

I have also already made the experience that with the HTTPS Policy you should first make the rules based on IP addresses at the top and then those based on applications below.

I had the applicaton based bypass rule in the first place and the policy did not work.

For me it seems like you have to pay attention to a certain sequence.

But I haven't found anything where it's documented.

Re: HTTPS inspection policy doubt

Chou_YiHsien — Mon, 14 Sep 2020 02:27:36 GMT

So there is priority
That is, I must first set the IP before setting up the application?

Does this have the documentation?

Re: HTTPS inspection policy doubt

PhoneBoy — Thu, 17 Sep 2020 04:46:13 GMT

Rules are evaluated per Column-based rule matching.
This applies to HTTPS Inspection policy as well.
If the connection matches the first rule, that is the rule that will apply.
In general, you should always have more specific rules first.

Re: HTTPS inspection policy doubt

_Val_ — Thu, 17 Sep 2020 07:33:56 GMT

@PhoneBoy just a small correction, for Unified Policy, and not for HTTPS Inspection, if AC/URLF and/or content inspection are in play, it might be that the connection will be matched to more than a single rule, pending streaming data decision.