Bypass HTTPS Inspection not working as intended ?

[George_Sas]

Hello guys

For some testing and debugging , I am trying to bypass everything on "deploy.static.akamaitechnologies.com".

Made a custom app like this :

Then made a HTTPS bypass rule on my outbound Policy and added it to the bypass.
This rule is right at the top as rule number 4 but when I look on the firewall logs I still see the "a95-100-154-113.deploy.static.akamaitechnologies.com (95.100.154.113)" is inspected ?

Why ? What I am doing wrong ? ... I'm out of ideas.

[simonemantovani · Accepted solution]

in my opinion, but I accept to be proven wrong, the issue is related to the certificate used by those sites, could you try using domain object?

[George_Sas]

Seems so , I added the destination as Domain ".deploy.static.akamaitechnologies.com" and this solved the issue.
And I came to same conclusion when I saw that some host onm akamaitechnologies.com was classified as "m365cdn.nel.measure.office.net" and some other host came just as IP.

Thanks.

[TurgutKaplanogl · Accepted solution]

Hello

Because deploy.static.akamaitechnologies.com  is a reverse DNS record, but you are creating a URL definition for the bypass. For this specific log you can define the bypass by creating a domain/FQDN object or if it is an accessed URL you can create the definition by specifying that URL.

TK

[George_Sas]

Well , well , well...

Did not help 😞
I can see HTTPS inspection on a95-100-155-104.deploy.static.akamaitechnologies.com (95.100.155.104)

I defined my rule like :

Source : Any

Destination : Domain .deploy.static.akamaitechnologies.com

Services : HTTPS Default services (https , 8080 )
Action Bypass

And I still get traffic inspected ?

[simonemantovani]

Uncheck FQDN.

https://support.checkpoint.com/results/sk/sk120633

[George_Sas]

Will test now. Btw this SK is GOLD for me in regards to domo_reverse_lookup ... think I found another solution for a problem that I had for LONG time 🙂

Will update you tomorrow.