topic Re: Hamony Connect - DLP not working in SASE and Remote Access

Hamony Connect - DLP not working

chethan_m — Fri, 29 Sep 2023 06:47:48 GMT

Hi Everyone,

I was testing Harmony Connect's Data Loss Prevention feature, and it doesn't seem to work.

1. I have created the Internet Access Rule as below:

Action	Name	Source	Destination	Content
Block	<name>	<Network & Users>	<email category> & <mail client applications>	<source code, MAC, PCI cards>

2. Set the SSL Inspection to Full Inspection.

3. Downloaded and imported the certificate to my computer's certificate store (Trusted Root Certificates)

4. Made sure to remove O365 objects from SSL inspection exception.

5. Activated full inspection on any site.

I'm still able to send MAC addresses, Source Code, Credit Cards numbers via email.

In the traffic logs I can see that HTTPS Inspection action is Inspect not Bypass and yet nothing's happening.

Is there something that I'm missing out?

Thank you,

Re: Hamony Connect - DLP not working

Shay-Mech — Fri, 29 Sep 2023 08:22:52 GMT

Thank you for bringing this issue to our attention, we will take a closer look at this and will update you as soon as possible

Re: Hamony Connect - DLP not working

chethan_m — Fri, 29 Sep 2023 08:45:45 GMT

Thank you.

Few more info from logs:

Action: Redirect
Inspection Action: Inspect
File Operation (Data Type Name): Source Code

Result: Email delivered with source code

Any Idea where It's redirected to? According to policy the traffic must be blocked.

Re: Hamony Connect - DLP not working

Tamir_Mitnitski — Fri, 29 Sep 2023 16:26:17 GMT

Hi Chethan,

After discussing with our team, I recommend we elevate this to a Service Request. This way, our TAC team can take a closer look at the use-case and the issue at hand.

As for the redirect action, this action is usually used to redirect users to notify them of a blocked HTTPS site or a certificate warning.

Thanks!

Re: Hamony Connect - DLP not working

chethan_m — Fri, 29 Sep 2023 18:35:35 GMT

Thank you, Tamir. I have opened the SR now. Will update the progress here too.

Re: Hamony Connect - DLP not working

EY — Wed, 11 Oct 2023 00:16:33 GMT

I thought it was a requirement (per sk179817) to install the HTTPS inspection certificate in both Trusted Root Certification Authorities and Third Party Root Certification Authorities.