SSL/TLS Rules

Because your SSLx Rule hits? 
SSLx has no relation what so ever with Firewall Rule.

The Firewall Rule specify what to do with Decrypted traffic. 

But everything else will be dealt with the DPI engine (SSLx). 

Thank you for your answer, I understand the way it works now.

But there is a bug the way SSL/TLS Inspection rules work.

If you specify an IP host group in the "source networks and devices", AND this IP host group is empty, then, ALL the traffic from any sources (even if they should not match this rule) will hit this rule. And then, if I add a host in the IP host group, only this IP host will hit this rule, and all of the other sources won't hit this rule and will hit the rules below this one, and everything works fine.

The bug is only when the IP host group is empty as source.

This is being tracked under ID NC-56773.

Thanks!

This is being tracked under ID NC-56773.

Thanks!

Ok, so no need to open a ticket on my side ?

Hi VikenNajarian 

No need for you to raise a case. Please stay tuned to this thread as we will provide updates when more information is available.