topic Re: HTTPS Inspection Probe Bypass on R80.20, should I enable? in General Topics

HTTPS Inspection Probe Bypass on R80.20, should I enable?

Alessandro_Marr — Thu, 07 Feb 2019 14:02:25 GMT

Hello, I´m using R80.20 Take 33, when I enable the flag enhanced_ssl_inspection some sites don´t open in browsers like chrome (version 58 or 71)... example: www.uol.com, www.bitcointrade.com.br...etc... any tips or sugestions?

Thank you.

Alessandro

Re: HTTPS Inspection Probe Bypass on R80.20, should I enable?

Kim_Moberg — Thu, 07 Feb 2019 17:01:48 GMT

Hi Alessandro

Is it SNI domains your are trying to access?

Did you try to analyze and inspect domains via https://www.ssllab.com? It will show you certicate type and which encryption is enabled.

I had to enable some encryption protocol levels when using probe bypass.

Best regards

Kim

Re: HTTPS Inspection Probe Bypass on R80.20, should I enable?

Emanuele_Lorenz — Wed, 13 Mar 2019 10:04:59 GMT

The behaviour has been changed, please look at sk104717:

Important:

In R80.10, before Jumbo Hotfix Accumulator for R80.10 Take 189, the probing feature is set, by default, to Fail Open.
From Take 189, the default behavior is changed to Fail Close.
You can return to the behavior as it was before Take 189, by setting bypass_on_enhanced_ssl_inspection 1

To set the default to Fail Open:

Run: fw ctl set int bypass_on_enhanced_ssl_inspection 1
In $FWDIR/modules/fwkern.conf, add this line: bypass_on_enhanced_ssl_inspection=1

The probing feature may fail in the following scenarios (and therefore it is not recommended):

Server requires an SNI extension in the SSL "Client hello" packet.
Missing cipher - The Security Gateway does not support any of the server allowed ciphers.
The server presents an incorrect certificate when SNI is not provided

To disable probing (Recommended):

Run: fw ctl set int enhanced_ssl_inspection 0
In $FWDIR/modules/fwkern.conf, add this line: enhanced_ssl_inspection=0