Difference between "Well-known Update Services" and "HTTPS services - recommended bypass"

[StephS]

Does somebody know what the difference between these 2 options is:

HTTPS Inspection Advanced Settings - Bypass Allow List - Well-known Update Services:

Updatable Objects - HTTPS services - recommended bypass:

Is it recommended to use both the setting and the Updatable Object? Are they equivalent to each other? sk98655 shows the same list of update services as in the Updatable Object, apart from VMware updates. So is that the only difference?

We're on R82, both MGMT and gateways. 

[Vincent_Bacher · Accepted solution]

It has been a long time since I used HTTPS inspection intensively, but in my youthful recklessness, I would argue that the former applies globally and the latter can be applied granularly in policies.

[StephS]

Ah, that makes sense. Thank you!

[the_rock]

This is what sk shows, more less what you posted. I use inspection in the lab, so happy to test whatever you need.

 

[the_rock · Accepted solution]

Just did some more lab checks and I see one that you mentioned for https bypass, seems more related to windows updates.

[StephS]

Hi Andy,

Thanks for testing. We're having a few small problems with updates and downloads from the MS Store after enabling HTTPS Inspection. We are not using the Updatable Object currently, so I'll try that next week, maybe it'll fix these problems 😀

[the_rock]

Sounds good, keep us posted!

[StephS]

Just wanted to update the thread. We tried the Updatable object, but it still didn't bypass the MS store traffic so we created a custom application with the MS domains seen in the log during the failed MS store update and that worked for us. So I guess, there's no difference content-wise between the Bypass Allow List in the Global Settings and the Updatable Object, just the possibility to set it granularly via the Updatable Object instead of being applied globally, as @Vincent_Bacher said.

[the_rock]

Thanks for the update. Yes, that makes sense.

[the_rock]

@StephS I did some lab tests today, since I have windows 11 PC behind R81.20 cluster with https inspection on. I disabled that option to bypass traffic to update services and after installing policy, windows update failed. Did not try mozilla one, but Im sure that would have failed too.