Security Features > Web Filtering - Best practice for BYOD Devices

Hello!

Daniel Hargrove said:

I have SSL / TLS Inspection enabled but I read somewhere about a certificate being needed to allow this to work correctly. 

You cannot do TLS Inspection with a BYOD network since It's necessary to have the certificate authority installed on each device. (But the DPI engine is still capable of doing web filtering with just the certificate information.)

Over the current settings, I recommend you to change:

Daniel Hargrove said:

Scan HTTP and decrypt HTTPS (currently disabled) 
Use zero-day protection (currently disabled) 

Enable both of those options, even If It can't scan HTTPS traffic - plain-text HTTP traffic will still be scanned. (For the Zero-Day protection, be sure you have a valid license before enabling It, a warning should appear if you don't have It.)

Daniel Hargrove said:

Filtering common web ports 
Use web proxy instead of DPI engine (currently enabled) 

Disable this option to use the DPI engine, currently the DPI engine is better (secure) and faster than the old web proxy. (This could be the reason on why internet browsing is slow.)

At last, depending on the scenario It's recommended to enable QoS for the BYOD Network.

Thanks!

Hi Prism

Many thanks for your detailed response. I will look to test with the recommendations you outined above. 

I assume with the inability to scan and decrypt HTTPS that the SafeSearch functionality will not work without this. Is this correct? 

Many thanks, Dan 

Hi, just another thought - If I enable Scan HTTP and decrypt HTTPS on the BYOD network will this cause errors if the Sophos Cert is not installed? 

Many thanks, Dan 

Not sure about all the details, but if it is attempting to decrypt TLS -- which will cause errors for users when their browsers see the firewall's certificates -- you can always turn that part off by setting up a TLS rule to not decrypt traffic on the BYOD zone.

Daniel Hargrove said:

If I enable Scan HTTP and decrypt HTTPS on the BYOD network will this cause errors if the Sophos Cert is not installed? 

No, the DPI engine is only capable of scanning plain-text HTTP traffic without TLS Decryption. (It won't give errors for the user if It's HTTP.)

The user will only get a certificate error if the website they accessed over HTTPS is being blocked though a web policy. (They will get a certificate error at first because the Firewall will try to redirect the user to a warning page, and in order to do this It needs to MITM (decrypt) the HTTPS connection.)

Daniel Hargrove said:

I assume with the inability to scan and decrypt HTTPS that the SafeSearch functionality will not work without this. Is this correct? 

The SafeSearch function is currently only available through the Web Proxy, but you can create a separate Firewall Rule just for this function.

(You can do this by creating another Firewall Rule on top of the current one with the "SafeSearch" FQDN's Group at the "Destination Networks", then enable the Web Proxy for the same Rule and use a Web Policy that have the "Enforce SafeSearch" function enabled.)

There are three things (at least in V19) that work together to cause TLS decryption, correct? One would be the checkbox in the Firewall Rule (Scan HTTP and decrypt HTTPS). This does not, by itself cause TLS decryption. Then there is the SSL/TLS Inspection Rules tab, which (in v19) has a master on/off switch. Then there are the rules themselves.

I think if no SSL/TLS Decryption rule applies, it falls off the end and does no decryption. So given that the OP didn't create an broad "decrypt it" rule in SSL/TLS Inspection Rules, it will drop off the end and so won't decrypt even though they check the box in the Firewall rule.

So there should be a hover-over "I" on the Firewall Rule checkbox next to "decrypt HTTPS" that says, "If an SSL/TLS Decryption rule would cause encryption". Is that right?

If you don't use the Web Proxy, then you're only able to trigger a TLS Decryption with a custom policy over the SSL/TLS Inspections Tab.

Wayne Folta said:

I think if no rule applies, it falls off the end and does no decryption.

Yes.

Wayne Folta said:

So there should be a hover-over "I" on the Firewall Rule checkbox next to "decrypt HTTPS" that says, "If an SSL/TLS Decryption rule would cause encryption". Is that right?

The "Scan HTTP and Decrypted HTTPS" naming sounds weird to be honest, since the DPI can send web traffic to be scanned from all ports then shouldn't this be called "Scan Web(HTTP)-based Traffic" or something as that?

The same applies on the "Filtering common web ports", the naming sounds as I need to enable It (Web Proxy) in order to get web filtering.

Actually not entirely correct. You can use the DNS Workaround provided by Google. https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/116641/safesearch---enforcement-when-using-the-dpi-engine

This should be possible with BYOD as well. 

The DNS workaround doesn't work if the user uses DNS over HTTPS/TLS.