v18 - Exclusions by application

Sophos decided to drop Application for now in SSLx.

https://community.sophos.com/products/xg-firewall/f/recommended-reads/118245/ssl-tls-inspection-rules-and-synchronized-applications

For netflix, the Exception for URL should be Enough (Netflix). 

Good to know, thanks for the information! 

NetFlix has always had trouble with proxies because NetFlix uses range requests which cannot be virus scanned and are therefore blocked when virus scanning is enabled, and they are poor at identifying themselves as NetFlix traffic which means it is hard to exclude them by default. Please see the pre-v18 KB125061 for more information.
community.sophos.com/.../125061

With v18 there is an additional problem. Netflix is using pipelined requests which are not supported by DPI mode. A pipelined request is where the client opens one connection, sends a request and then sends a second request before the reply to the first response arrives. It is not used very often because of poor support and no performance gain when it is supported, and is disabled by default in browsers.

See here for more information:
stackoverflow.com/.../why-is-pipelining-disabled-in-modern-browsers

HTTP pipelines are supported within the traditional web proxy because it does head-of-line blocking, which de-pipelines and forces the requests in order. That means the pipeline doesn't get any performance gain, which is why no one uses pipelining. Except apparently Netflix. Admittedly, streaming video is one area that pipelining may make sense.

There are currently three workarounds. These were posted in EAP but I never got feedback/confirmation that all three worked. Eventually I will integrate this into the KB.

1) Create a firewall rule with destination network "Netflix" that does not have any Web policy or malware scan. This is the same configuration as KB125061 (solution 1) but in 17.5 it uses proxy mode and in 18.0 it uses DPI engine.

2) Create a firewall rule with destination network "Netflix" that has Web policy=Allow All, do not scan for malware, use proxy. This is similar to KB125061 (solution 1) but it make sure it uses the web proxy and therefore 18.0 behaves like 17.5.

3) Use existing firewall rules (don't create anything special), that are Use Proxy. Create AV exceptions as per the KB. This is the same as KB125061 (solution 2) just making sure that it uses the web proxy so that 18.0 behaves like 17.5.

If you have a TV and you don't care about malware scanning any traffic on that device you can use Solution 1 or 2 specifying your TV as the source network instead of the Netflix destination.

Thank you, I've already found your post in another thread.

I've decided to try option two.

I'll let you know if it works for me.