Why can I Download EICAR wenn DPI is on

Hi Dirk,

please post a copy of your firewall rule and the SSL/TLS rule which are causing the issue.

Ian

Same here for me with the mirror abvoe.

On this mirror my XG is blocking EICAR:

If you use DPI Engine, is the website decrypted? Do you see the Certificate replaced of this website? 

Check if http://sophostest.com and https://sophostest.com work as expected. 

Hi Dom,

I was able to download all but one of the files, the Sophos Home premium stopped all of them on my MBP.

You have raised an interesting question.

Basically from the test DPI appears to check the connection, but not the content, that would appear to be a big weakness in the DPI setup/build?

So you need the proxy for content scanning and DPI only does the connection security.

When I performed the test I disabled the web proxy two boxes and left the other web security as was.

Lets us hope that support whizkid reviews this thread and can enlighten us on our configuration or expectation failings.

Ian

Hi folks,

further thoughts on this issue. You would need to setup an SSL/TLS rule that enables decrypt and not use the default rule. I suspect that is where my tests have gone wrong because I am using the default rule which is do not decrypt.

Ian

I checked it in the logs:

The download is hosted on meineipadresse.de and my profile does encryption on it.

However it is TLS1.3. Maybe this is a bug or fallback behrvior  in XG?

(I have encryption for 1.3 active as well)

I tested this a couple of different ways, using both the web proxy and DPI - neither blocked the download from eicar.org (both the HTTP and HTTPS links) with decrypt and scan disabled (that is in the SSL "decrypt all" rule itself).

Sophos Home picked it up regardless, as did the XG when HTTPS inspection was enabled. That struck me as being a bit weird, though I've not looked closely at anything.

The check content for malware was turned on in all instances, I don't have a v17 to check this behaviour against.

Regards

Hi,

a little bit feedback from TO.

My problem with DPI ... missing/incorrect "SSL/TLS inspection rules" within "Rules and policies".

Try it again the last days ... working without problems .. if configured correctly.

Hallo,

here are my rules:

My SSL/TLS Inspection rule:

This ssl/TLS rule is by sophos:

My Firewall Policy:

Dirk

Assuming we are currently waiting for V18.0 MR1, i would suggest to install MR1 and retest this website. Actually it should work as expected.