HTTPS Inspection Statistics Dashboard

[GigaYang]

There is a new report in R82 SmartEvent.

But I found that the content only appeared after our Gateway was upgraded to R82.

So I would like to ask:
1. Both SmartCenter and Gateway must be R82 version.
2. What are the detailed differences in the format and content of the HTTPS Inspection Log between R82 and R81.x?

Thanks

[the_rock]

What is the name of it, if you can please provide that? I attached a screenshot of what I see in my R82 lab se server.

Andy

[the_rock]

Or maybe its custom report? Let me test it in my lab.

Andy

[GigaYang]

It is the default report for R82, as attached.

Thank you

[the_rock]

Yes, got it. I assume gateway would need to be on R82 for this to work fine, since my mgmt is R82 and SE server as well, but cluster is still on R81.20

Andy

[the_rock · Accepted solution]

Ok, I built purely R82 lab for ssl inspection and was able to test this. To answer your questions.

1) YES

2) Detailed differences...I could not really see many myself. I would say it all depends if you have extended log option selected under logging. Whats different is some new options for inspection in smart console that are accessible via regular smart console, rather than having to access legacy one.

Hope that helps.

Andty

[GigaYang]

Hi Andy,

Thanks for your kindly help.

When we used R81.10 in Gateway, we had already enabled the Extended Log setting in APCL.

[the_rock]

Any time my friend, of course! Yes, that makes sense, so I would leave it like that even in R82.

Andy

[PhoneBoy]

The additional HTTPS Inspection logging in R82 is commensurate with the new functionality added in this release:

• Enhanced HTTPS Inspection UI - HTTPS Inspection is fully managed in SmartConsole.
  • Enhanced HTTPS Inspection policy - A dedicated policy for inbound inspection, including certificate management views for both inbound and outbound policies and enhanced default outbound policy.
  • Trusted CA package - A new view to manage Trusted certificates and see the status of the trusted CA package.
  • HTTPS Inspection Advanced settings- A new view to configure advanced settings, including R82 new features.
• Client Side Fail mode - This new feature automatically detects failures in inspected TLS connections caused by client-side issues, such as certificate-pinned applications. When a failure is detected, the connection is flagged to be bypassed in future attempts, and Artificial intelligence (AI) learns from these failures to identify similar connections.
  • Endpoint Detection - Identifies endpoints without deployed outbound CA certificate.
• Learning mode:
  • Gradual & Smart deployment - Activated during the deployment of HTTPS Inspection, inspecting a minor percentage of traffic over two weeks.
  • Network Learning - Gathers insights into network behavior and detects potential connectivity issues for Artificial intelligence consideration.
  • Performance Prediction - Estimates the impact on performance when HTTPS Inspection is fully implemented.
• Bypass Under Load - Bypasses TLS connections when the Security Gateway experiences high CPU load.
• HTTPS Inspection monitoring - Introducing the HTTPS Inspection statistics view in SmartView, including bypass/inspect statistics.

[GigaYang]

Hi PhoneBoy,
Thank you for your explanation, it is very helpful to us.