Web Proxy vs DPI

Question

Hi Everyone, 
 I finally moved our XG over to version 18 yesterday and no hiccups. My question is I am wanting to get SSL/TLS Inspection setup correctly for our environment and I noticed when I toggled of SSL/TLS inspection->ON, it must automatically toggle on 'Scan HTTP and HTTPs and Use Web Proxy over DPI' on our main firewall LAN->WAN rule. I did a bit of reading and when I unchecked Use Web Proxy over DPI, my mobile users had a lot of issues, alot of apps no longer worked, some couldn't get an Internet connection, by using DPI it seems to break my mobile users, have a missed something? 
 
 Thank you.

LuCar Toni · Accepted Answer

Basically you have two different Decryption modules. Old school proxy (within the firewall rule) and the DPI Engine. 
 Likely you should start to decrypt with a client first and check about the compatibility. 
 HTTPS decryption needs to have a exported Certificate: https://support.sophos.com/support/s/article/KB-000038420?language=en_US --> This part is the same for both modules.

Web Proxy vs DPI

Top Replies