Office 365 Bypass Decryption

[DarrenR]

I'm creating a firewall policy to support Office 365 traffic and I'm running into an issue (by design) regarding the decryption of Office 365 endpoint traffic. I've enabled HTTPS inspection globally, as well as inspection bypass for Office 365 endpoints, but the challenge I'm running into is that the Checkpoint will still perform SSL decryption on all traffic (because inspection is enabled globally). 

Microsoft recommends against decryption of Optimize and Allow category endpoints...Is there any way to bypass decryption (easily) for these endpoints? Ideally using updatable objects?

Obviously a bit of a catch-22 here. We need HTTPS inspection so we can recognize traffic that we'll allow out, but the global decryption settings create an issue for these two endpoint categories. 

Any thoughts are appreciated!

[PhoneBoy]

R80.40 Gateways will allow the use of Updatable Objects in the HTTPS Inspection policy.
In earlier releases, this would have to be manually maintained.
However, there is a script that can be used for this.
In this case, it's in the context of an Encryption Domain, but you can use the group for anything.
https://community.checkpoint.com/t5/Remote-Access-VPN/Route-O365-traffic-local-and-not-in-VPN-tunnel...

[#3]

Very familiar with the R80.40 enhancement allowing the use of Updatable Objects in the HTTPS inspection policy, and this is working as designed (logs are reporting that O365 endpoints have been bypassed). The challenge, however, is that because HTTPS inspection is enabled globally, the Checkpoint will still perform SSL encrypt/decrypt, evident in the fact that the firewall will replace the SSL certificate.

I can't think of any way to completely bypass SSL encrypt/decrypt functionality, so thought I'd throw this out to the larger community. Attached are a couple of screenshots detailing the issue when testing connectivity from https://connectivity.office.com. 

[#4]

Very familiar with the R80.40 enhancement allowing the use of Updatable Objects in the HTTPS inspection policy, and this is working as designed (logs are reporting that O365 endpoints have been bypassed). The challenge, however, is that because HTTPS inspection is enabled globally, the Checkpoint will still perform SSL encrypt/decrypt, evident in the fact that the firewall will replace the SSL certificate.

I can't think of any way to completely bypass SSL encrypt/decrypt functionality, so thought I'd throw this out to the larger community. Attached are a couple of screenshots detailing the issue when testing connectivity from https://connectivity.office.com. 

[#5]

Very familiar with the R80.40 enhancement allowing the use of Updatable Objects in the HTTPS inspection policy, and this is working as designed (logs are reporting that O365 endpoints have been bypassed). The challenge, however, is that because HTTPS inspection is enabled globally, the Checkpoint will still perform SSL encrypt/decrypt, evident in the fact that the firewall will replace the SSL certificate.

I can't think of any way to completely bypass SSL encrypt/decrypt functionality, so thought I'd throw this out to the larger community. Attached are a couple of screenshots detailing the issue when testing connectivity from https://connectivity.office.com. 

[#6]

Very familiar with the R80.40 enhancement allowing the use of Updatable Objects in the HTTPS inspection policy, and this is working as designed (logs are reporting that O365 endpoints have been bypassed). The challenge, however, is that because HTTPS inspection is enabled globally, the Checkpoint will still perform SSL encrypt/decrypt, evident in the fact that the firewall will replace the SSL certificate.

I can't think of any way to completely bypass SSL encrypt/decrypt functionality, so thought I'd throw this out to the larger community. Attached are a couple of screenshots detailing the issue when testing connectivity from https://connectivity.office.com. 

[#7]

Very familiar with the R80.40 enhancement allowing the use of Updatable Objects in the HTTPS inspection policy, and this is working as designed (logs are reporting that O365 endpoints have been bypassed). The challenge, however, is that because HTTPS inspection is enabled globally, the Checkpoint will still perform SSL encrypt/decrypt, evident in the fact that the firewall will replace the SSL certificate.

I can't think of any way to completely bypass SSL encrypt/decrypt functionality, so thought I'd throw this out to the larger community. Attached are a couple of screenshots detailing the issue when testing connectivity from https://connectivity.office.com.