DPI vs Web Proxy

Question

Hello everyone, 
 
 At the moment we are thinking about changing from Web Proxy to DPI on XG 230. As I understood from public documentation, there are some features, only supported with Web Proxy mode, but we are not using any of these currently. 
 Therefore came up another question aswell: What happens if I disable web proxy in firewall rule and keep the proxy setting on clients enabled? Will DPI or web-proxy be used or will the traffic get denied because there is no rule with web-proxy enabled? 
 
 But my main question is what "mode" you are currently using and what were the reasons for this. 
 
 Best regards, 
 Jonas

Michael Dunn · Accepted Answer

You should read Sophos Firewall v18: XStream - the new DPI Engine for web proxy explained As well as the "DPI engine or web proxy" help popup that is inside the firewall rule. Yes file type are blocked for any HTTP or HTTPS traffic that is decrypted (same as web proxy). Note: The checkbox for "Filtering common web ports - Use web proxy instead of DPI engine" only applies to transparent mode traffic. If browsers have specified to use the XG as a web proxy then proxy must be used. "Deep Packet Inspection" engine can only look at packets going through the XG to a destination. I would argue that the number of websites that have issues with HTTPS scanning is equal in Proxy and DPI mode. If you already have exceptions that work for you it should be fine. The one place where you can sometimes be caught is DPI mode looks at all ports. Potentially you have an app talking to a server using TLS on port 12345. Currently that traffic is hitting some firewall rule and also hitting a TLS inspection rule. It is already being handled by DPI mode but you (most likely) are not decrypting it. If you add a TLS rule that decrypts all traffic on all ports then it starts being decrypted and there is a chance it will have problems. Apps that run on their own high level ports tend to be more... fragile because they don't always follow HTTP standard when talking to their own server.

rfcat_vk · Answer

Hi, 
 you would need to disable the (or delete) firewall rule and create an SSL/TLS rule. The firewall will pass/process the traffic regardless of source. The exception list of sites that don't like SSL/TLS inspection is quite large so would pay to review that list before deciding to not use the web proxy. 
 Ian

DPI vs Web Proxy

Top Replies