This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web filter with content filter strange behavior

I'm trying to test the web filter with a content filter and am experiencing unexpected behavior.

I've created a blocked terms list with the following term:

and uploaded it to a content filter called blocked_terms. I've also set up a web filter policy, firewall rule and ssl inspection policy to accordingly(scroll down to see) yet when I visit a page with the term coronavirus, the page is not blocked.

And when I refresh the page its blocked:

And the policy tester says that the page should not be blocked:

web fillter policy as below:

relevant firewall rule:

SSL inpection policy rules are below:

web filter general settings as below:

I also installed the correct https CA certificate on my browser(firefox).

Please advise...

This thread was automatically locked due to age.

Parents

0 Raphael Alganes 9 months ago

Hello Teererai Marange ,

Thanks for reaching out to Community.

Wanted to check if this post is related to your other opened thread? RE: Keyword blocking not working with DPI engine enabled.

If it is, kindly update the first thread instead of opening another with a related or similar topic to avoid redundancy so other users on the first thread can follow along with your updates, follow-up questions, etc.

Have a nice day and thank you for choosing Sophos.

Cheers,

Raphael Alganes
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Raphael Alganes 9 months ago

Hello Teererai Marange ,

Thanks for reaching out to Community.

Wanted to check if this post is related to your other opened thread? RE: Keyword blocking not working with DPI engine enabled.

If it is, kindly update the first thread instead of opening another with a related or similar topic to avoid redundancy so other users on the first thread can follow along with your updates, follow-up questions, etc.

Have a nice day and thank you for choosing Sophos.

Cheers,

Raphael Alganes
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Teererai Marange 9 months ago in reply to Raphael Alganes

It is not related. The issue in the first thread was that the DPI engine was not decrypting my pages. In this case I am trying to use a content filter with unexpected results.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk 9 months ago in reply to Teererai Marange

You are aware that you are using the web proxy even though your test advises otherwise? Also please check logviewer to see which rule rule is being used by this test.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Bharat J 9 months ago in reply to Teererai Marange

Hi Teererai Marange

Which certificate CA you see on address bar ?

Regards

"Sophos Partner: Networkkings Pvt Ltd".

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Teererai Marange 9 months ago in reply to Bharat J

Certificate is attached.

TLS inspection logs:

Web filter logs:

Log viewer logs are also attached.
Cancel
Vote Up 0 Vote Down

Cancel
0 Bharat J 9 months ago in reply to Teererai Marange

Check mark Use web proxy instead of DPI engine and Search engine enforcement and check web filter logs under logviewer :

Remove "AllWebTrafficCategory"

So,you need a rule with the action of "Decrypt" in the new "SSL/TLS Inpsection Rules" in order for the Firewall to scan HTTPS traffic with the DPI Engine and above changes.

You can find more information about this at the Sophos Docs. https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=rules-policies-SSL-TLS-add

Regards

"Sophos Partner: Networkkings Pvt Ltd".

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel