RE: IPS with webproxy/MTA/WAF

Tomas Beran — Sat, 31 Oct 2020 12:45:46 GMT

Hello Emmanuel,

thanks for feedback.

I did a test with webproxy when it is configured in browser (NO transparent).
The IPS seems to be triggered on http cleartext traffic.
But IPS does not trigger for HTTPS traffic even if it is decrypted by webproxy.

So my conclusion is:
1. IPS is applied to traffic passing through IPS engine to webproxy port. With HTTPS it sees only the SSL/TLS stream.
2. the decrypted cleartext traffic by webproxy in this scenario is not scanned by IPS itself -> no reason to enable it if most traffic is HTTPS and in this case it does not protect clients
3. probably the same for Application contorol

I would expect that the same is for WAF if all traffic is https. IPS can see only SSL/TLS stream, but can't see the inner clear text traffic to protect for example vulnerabilities in web server etc.

RE: IPS with webproxy/MTA/WAF

emmosophos — Fri, 30 Oct 2020 22:43:29 GMT

Hello Tomas,

Thank you for contacting the Sophos Community!

Yes, IPS will work for Web Proxy, MTA and WAF Traffic.

Regards,