topic YouTube Block rule in AppControl Blade behavior - HTTPS Inspection in General Topics

YouTube Block rule in AppControl Blade behavior - HTTPS Inspection

Jake_Stafeyev — Thu, 14 May 2020 07:08:42 GMT

Hi,

I face some unclear behavior in my 80.20 setup.

Scenario:

1. Enabled AppControl and created a rule to block YouTube.

2. Installed Policy - warning "YouTube application requires HTTPS Inspection blade which is turned off...".
Obviously, at that point YouTube works fine and not being blocked.

3. Enabled HTTPS Inspection and face the following:

- When trying to reach Facebook - it is alerting that the computer is not trusting the website although I installed the GW certificate on it. Can anyone tell me why?

- When disabling the HTTPS Inspection, YouTube is still being blocked (while Facebook is OK now). Can anyone tell me why? The HTTPS Inspection is disabled.

Thanks in advance!

Jake

Re: YouTube Block rule in AppControl Blade behavior - HTTPS Inspection

PhoneBoy — Fri, 15 May 2020 21:20:24 GMT

What's the precise error you get and what is the certificate you are presented with?
Please provide screenshots.

It is possible to block Facebook and YouTube without HTTPS Inspection thought it may not always be reliable.
IT will work more reliably if you install the latest JHF for R80.20 and enable HTTPS Inspection (can have just any any any bypass rule).
This should enable SNI verification which will make app identification more reliable.

Re: YouTube Block rule in AppControl Blade behavior - HTTPS Inspection

Jake_Stafeyev — Sun, 17 May 2020 06:33:19 GMT

Hi!

The signature issue was solved, we didn't install it in the correct directory on the PC.

The thing with YouTube block is that it didn't work before enabling HTTPS Inspection yet it worked after enabling and disabling again.

So the reason is not clear.

Is there some "first-time" trigger?

Jake

Re: YouTube Block rule in AppControl Blade behavior - HTTPS Inspection

PhoneBoy — Mon, 18 May 2020 01:05:53 GMT

Not sure why it wasn't working before.
It'd be something the TAC would have to assist in troubleshooting.