Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 12 replies
  • Subscribers 42 subscribers
  • Views 10013 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL/TLS inspection

wingman

Hi All

I am facing a strange error whereby there are no logs in the SSL/TLS inspection even though it SSL inspection is enabled and sophos is MiM the tls traffic. SSL Traffic is sucesfully decrypted on the end client using a custom CA. Logging in enabled in the Decyrption rules but there is nothing is the log viewer

Thanks



This thread was automatically locked due to age.
  • 0

    Just to get some information correct: 

    DPI Engine will only work for stream based traffic (Traffic going through the appliance to the webserver). Not Direct Proxy or other kind of traffic. 

    The Checkbox in the firewall rule "Decrypt HTTPS during web filtering" will activate the legacy proxy and therefor overwrite the DPI engine. 

    __________________________________________________________________________________________________________________

  • +1

    The firewall rule that show - the "use web proxy instead of DPI engine" setting applies to port 80/443 traffic (eg transparent mode).  If you are using standard/direct mode on port 3128 then it will always use the proxy (even if the box is unchecked).  Click on the (i) icon in the firewall rule for more information, also see community.sophos.com/.../sophos-xg-firewall-v18-xstream---the-new-dpi-engine-for-web-proxy-explained


    If using the proxy, the checkbox "Decrypt HTTPS during web proxy filtering" takes effect.  There is nothing logged to the Log Viewer TLS log.

    If using DPI mode, the decryption is controlled by the SSL/TLS tab.  HTTPS traffic is logged to the Log Viewer TLS log.


    The policy tester will accurate show what is configured for transparent mode traffic.  There is no way to indicate on the tester that you are using direct mode, so it might not be as accurate.

Unfiltered HTML