topic https inspection is not working in General Topics

https inspection is not working

abihsot__ — Mon, 26 Nov 2018 08:56:25 GMT

Hi Guys,

I have a strange problem with https inspection. Something I am missing here and run out of options.

R80.10 with appl/urlf/https inspection turned on. Enhanced ssl inspection is on.

cat $FWDIR/boot/modules/fwkern.conf
enhanced_ssl_inspection=1

https inspection policy:

my computer -> internal networks; any category; action: bypass

my computer -> internet; specific URLs; action bypass

my computer -> internet; any category; action: inspect

First problem - there are no inspect logs. Only bypass for first https inspection rule.

Because it is not inspected, in appl/urlf policy my traffic avoiding first rules and hitting last one - any -> internet; action allow.

wstlsd.elg file contains only:

[26 Nov 8:39:04] wstlsd_init: Instance #0 of Daemon initiated successfully
[26 Nov 8:39:04] wstlsd_init: Instance #2 of Daemon initiated successfully
[26 Nov 8:39:04] wstlsd_init: Instance #4 of Daemon initiated successfully

Any ideas?

Re: https inspection is not working

Evgeniy_Olkov — Mon, 26 Nov 2018 10:30:31 GMT

Hello. Please check your network topology. You must be sure that you have an 'external' interface.

Re: https inspection is not working

abihsot__ — Mon, 26 Nov 2018 11:38:00 GMT

Hi,

thank you for suggestion! However I thought about this too, so I modified my https inspection policy to:

my computer -> internal networks; any category; action: bypass

my computer -> any; specific URLs; action bypass

my computer -> any; any category; action: inspect

Still no luck.

By the way in firewall topology I have external interface defined.

Re: https inspection is not working

Evgeniy_Olkov — Mon, 26 Nov 2018 11:44:25 GMT

Yes, I mean the firewall network topology. I had the same isue two weeks ago. After many actions I have just reconfigured the topology (override - External -> Internet) and installed the policy. And it has started to work.

Re: https inspection is not working

abihsot__ — Fri, 28 Dec 2018 07:04:25 GMT

Hi Guys,

Just wanted to let you know that after removing identity awareness object from https inspection policy it started working... However I am still not happy how it works. I'll do some more testing