Block search words in XGS2100 not working

Hi Junaid Farooqui

Please enable Malware and Content scanning on firewall rule to make it work.

Refer : Configure SSL/TLS inspection and decryption:  https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/index.html?contextId=web-SSL-TLS-inspection-decryption for more help.

Also, Sophos Firewall: HTTPS Decrypt and Scan FAQ  Sophos Firewall: HTTPS Decrypt and Scan FAQ  

Regards

When there is an HTTPS connection with no HTTPS decryption the proxy cannot see the full URL that they are going to, only the hostname.

All search engines use HTTPS.  Therefore currently the custom category that you created would only trigger if those words appear in the hostname.  If you want to use the web proxy apply policies based on the full URL you need to Decrypt HTTPS.

Thank you Michael Dunn . Did you mean to enable "Decrypt HTTPS during web proxy filtering"? under firewall rules? All traffic get blocked if I enable this feature.

Hi,

have installed the XG CA on the devices?

Ian

This KBA written by Michael might help.

https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/121482/sophos-firewall-https-decrypt-and-scan-faq

Previously not. I have just now tried after importing the certificate manually on a machine, in browser but didn't work.

Try this steps again 

https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Certificates/HowToArticles/CertificatesAddCAManually/index.html#install-the-ca-in-operating-systems 

Regards

Bharat J  I did try but the search still showed up after the import in browser and O.S as well.

Check default CA is uptodate ?

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/index.html?contextId=DefaultCertificateAuthorityEdit 

Please go to developer tool and share view certificate under Security on web browser.

Regards