Suspicious traffic passed through Implied Rule - accept_outgoing

[Ruan_Kotze]

Hi All,

I'm investigating an issue that I can't quite get my head wrapped around.

As part of our CP estate we have an OpenServer acting as an explicit proxy. This works well for the most part, but our SOC team has flagged traffic being allowed by an implicit rule. Properties generally looks like this

Source: External IP of Proxy
Destination: Random public IP's
Port: 80 and 443 for the most part. Also TCP 3478 and other non-check point ports
Rule: 0
Rule name: Implied Rule - accept_outgoing (after enabling additional implied rule logging as per sk110218)
Source User: Blank (even though our actual policies are identity based)

I understand that there is traffic that needs to be allowed by the Implied rules, but what I do not understand is why for example TCP 3478 (and several other TCP ports) is being passed?

Any insight appreciated. I've not really supported any proxy deployments before, so perhaps that is adding to my confusion:-).

Thanks,
Ruan

[PhoneBoy]

The 443 traffic is likely due to SNI verification, which occurs on ALL HTTPS traffic whether HTTPS Inspection is enabled or not.
Specifically, we make sure the SNI matches what the server provides as part of its certificate.
This requires a separate connection from the gateway.

Port 80 traffic is likely ThreatCloud lookups that occur from the gateway.

For the other ports, can't say for sure.
Are the ports in question allowed outbound and possibly being used for HTTPS?