HTTPS Inspection is always bypassed - "Inspection is not Required"

[Nikolas135096]

Hi community,

I’m running into an issue with HTTPS Inspection and would appreciate your insights.

I’ve configured HTTPS Inspection to the best of my knowledge:

* HTTPS Inspection is enabled on the firewall
* There is an outbound rule with the action set to **Inspect**
* The inspection certificate is properly installed on the client

However, inspection is never actually triggered. All traffic is consistently marked as **Bypass**, with the reason: *“Inspection is not required.”*

Has anyone encountered this behavior before or knows what could cause this? Are there specific conditions, rulebase settings, or blade interactions that might lead to traffic being skipped with this message?

It's an Open server with R82 Take 91.

Thanks in advance!

Niko

[PhoneBoy]

Most likely, this is going to require a TAC case.
I've never seen this message myself and don't see it mentioned in any TAC cases.

[the_rock]

Never seen it either...

[Nikolas135096]

Thanks a lot for your fast replies. I'll open a TAC case.

[the_rock]

Let us know how it goes.

[Bob_Zimmerman · Accepted solution]

Do you have a rule which needs to see inside the traffic? For example, are you applying AV scanning?

HTTPS Inspection isn't an end in itself. It's a feature to allow other inspection to work. If there's no other inspection which depends on it, maybe the firewall doesn't insert itself into the TLS negotiation because inspection is not required.

[Nikolas135096]

You're absolutely right. As soon as I enabled Threat Prevention, the traffic was inspected. Thank you very much!

Interestingly, even the support team hadn't seen that message before.

[the_rock]

I just ran your screenshot through chatgpt and below iw aht it gave me. Not sure if you can double check these points:

*****************************

This screenshot is from a Check Point log (likely SmartLog / SmartConsole), and it’s showing how a specific connection was handled by your security policy.

Here’s what each field means:

Action: HTTPS Bypass

• The traffic matched a rule that bypasses HTTPS inspection.
• In plain terms: the firewall did NOT decrypt or inspect the SSL/TLS traffic.

Action Reason: Inspection is not Required

• This explains why it was bypassed.
• The policy determined that this connection is trusted or excluded, so deep inspection wasn’t necessary.

Policy Management: NK-CP-MGMT

• This is the management server that pushed the policy.

Policy Name: IDAwarenessPolicy

• The connection matched a rule inside your Identity Awareness policy.
• Likely tied to user/group-based rules rather than just IP/port.

Policy Date: Yesterday, 16:51:30

• Timestamp of when the policy currently installed on the gateway was applied.

---

What this means overall

Traffic matched a rule that explicitly says:

“Allow HTTPS traffic without SSL inspection.”

This is commonly done for:

• Trusted domains (banking, Microsoft, etc.)
• Privacy-sensitive traffic
• Applications that break under SSL inspection
• Performance optimization

---

Why this matters

Because it was bypassed:

• No SSL decryption happened
• No deep threat inspection inside the encrypted payload
• Only basic inspection (IP, port, SNI, etc.) was applied

---

If you’re troubleshooting

This log tells you:

• If you expected HTTPS inspection → your rulebase is bypassing it
• If something is being missed (e.g., malware detection) → this could be why