Can I totally bypass HTTPS inspection for a particular URL ?

[championc1]

Can I create a Security Rule to allow HTTPS to a specific Domain and totally bypass HTTPS inspection for a particular URL, rather than creating a Bypass Action rule in the HTTPS Inspection Policy ?

I want to permit access to a particular external URL without the possibility of HTTPS inspection doing something.  We have had several instances recently where the Bypass action rule has stopped working, leading to all of the traffic being inspected, which then breaks access to the external website.

I found that I needed to re-push the policy with Threat Prevention ticked in order to get the Bypass Action rules to start working again

[the_rock]

Well, you can create a rule allowing access to that domain using say domain object or custom url object, as long as you have urlf blade enabled in network layer. I cant guarantee that would work, but you can certainly give it a go.

Andy

[the_rock]

I should have clarified...if you have separate urlf ordered layer, thats where I would create the rule.

Andy

[PhoneBoy]

Yes, that's why we have an HTTPS Inspection policy.
However, the decision to bypass inspection cannot be made on a full URL, but only on a specific host.
The reason: most web connections are HTTPS and access to the URL requires full HTTPS Inspection (the very thing you're trying to avoid).
If you use an App Control category or Custom Application/Site in your policy, this requires App Control.

A screenshot of your actual HTTPS Inspection policy might be helpful along with version/JHF information.

[the_rock]

Good points!