DLP blade is not working as expected

[Phillip-83]

Hi everyone,

I'm setting up DLP Blade for POC at the customer (OpenServer - R81.20) but seems like it's not working correctly.
Here is the Policy: 

So when the client behind the gateway tries to upload files: 

Some sites working get log and alert email: Gmail, LinkedIn, Onedrive,...

Some sites are not working (no DLP log, just normal traffic log): Google Drive, Facebook, Telegram,...

Other Blade I set the default configuration so I don't think it's a conflict.
Have I configured something wrong? 

Please help me.. 

Thank you so much.

[Lesley]

Are you doing HTTPS inspection on this traffic?

The logs shows UDP 443 that is encryped.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...

[Phillip-83]

Https inspection already done: 

I did install cert on client, in GG Drive website, that show https inspection cert: 

 

[Lesley]

That is good! UDP 443 cannot be inspected and would be best to block. As others already posted. I can see you have done this now.

Further info about this is listed here: https://support.checkpoint.com/results/sk/sk111754

Could it maybe be a character / language issue? If I see your screenshots 🙂

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_DataLossPrevention_AdminGuid...

[Chris_Atkinson]

Are you blocking QUIC traffic in your environment?

[Phillip-83]

I'm testing with allow *any all, and block only quic UDP-443 in FW Layer, but DLP on GG Drive, Facebook,... still not working:

 

[the_rock]

Does zdebug show anything for the IP site resolves to?

fw ctz zdebug + drop | grep x.x.x.x

Just put the ip address after grep

Andy

[Phillip-83]

When i'm trying upload to drive: 

 

run command I saw it's not dropping anything: 

[the_rock]

As Chris said, QUIC can definitely be the issue.

[Binhn]

Hi the_rock, do we support to do the DLP Policy for native applications such as Google Driver, Telegram, Dropbox...? 

[the_rock]

You may want to ask internally as well, but Im pretty sure you do support it.

Best,

Andy