Good day,
I have discovered what appears to be an unusual issue on our security gateways (R81.10) that may be related to HTTPS inspection.
When one of our internal devices communicates to a specific external destination (the only destination its allowed to communicate to) over HTTPS. The logs show 3 entries - 1 for the accept, 1 for the HTTPS inspection bypass, but one other uncommon one from the active gateway node to the same destination over HTTPS. The expected outgoing packet is NAT'd as expected, and the packet from the gateway is NAT'd to the VIP address. These packets are all logged with the same time.
The firewall guy at the destination end is seeing traffic from both of the NAT'd IPs indicating that that traffic is actually going out our gateway to the remote end.
We have another internal device that connects to a specific destination out the same interface over https and it too is showing the same additional https packet from the gateway.
Other HTTPS traffic through the same interface does not generate the same extra packet.
Here's an anonymized excerpt from the logs:
| Time | Blade | Action | Type | Interface | Origin | Source | Source User Name | Destination | Service | Rule | Access Rule Name | Policy Name | Description |
| 2023-06-19 11:17 | Firewall | Accept | Connection | ethX | gateway2 | Node1 (10.1.1.1) | | 1.1.1.1 | https | 7 | Geo Protection Accept Cleanup Rule | Standard | |
| 2023-06-19 11:17 | HTTPS Inspection | HTTPS Bypass | Log | | gateway2 | Node1 (10.1.1.1) | | 1.1.1.1 | https | | | Standard | |
| 2023-06-19 11:17 | Firewall | Accept | Connection | ethY.1234 | gateway2 | gateway2 (x.x.x.x) | | 1.1.1.1 | https | 0 | Implied Rule | Standard | |
If anyone has an idea of why this is happening, that would be great. Haven't noticed this behavior in the past.
Thanks!
