Changed behaviour when you click on blocked categories like "Advertisements"

I typed in "iPhone 11" in google search i got the following advertisements listed first:

Now when you click on the first listed results (Anzeige=Advertisements) in proxy mode you got the following block page:

But when you change to DPI you can now click on the advertisement and the site behind it will load.

So how will be the behaviour when you click on a malicious site? Will the traffic just pass by and only the malicious site will get blocked, other content after the click will be loaded normally? There will be no interruption?

0 Prism over 5 years ago

Hi,

Same behavior is happening with me, if I use DPI none of the policies seems to be applied to the rule.
One thing, do you have 4GB or 8GB of RAM?
Apparently there's some serious performance degradation on 4GB compared to 8GB, I'll be upgrading to 8GB (6GB Usable) soon for some testings.

Also, there's a new post here on the forum that says the DPI engine isn't working correctly on 4GB RAM.

https://community.sophos.com/products/xg-firewall/sfos-eap/sfos-v18-early-access-program/f/feedback-and-issues/115989/unable-to-use-dpi-with-a-system-with-4-gb-of-ram---bug

Thanks,

If a post solves your question use the 'Verify Answer' button.

Ryzen 5600U + I226-V (KVM) v21 GA @ Home

Sophos ZTNA (KVM) @ Home
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PMStuart over 5 years ago in reply to Prism

Can you please post some screenshots of your firewall rule and SSL/TLS rules.

I just checked this here and only using the DPI engine categories are blocked according to the policy on the matching firewall rule.

here is my rule

and my TLS rule
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 TheBalmasque over 5 years ago in reply to PMStuart

Hi,

i use the same firewall rule with web proxy checkboxes not ticked. (Use DPI instead)

And this is my DPI scanning rule:

I just put in my computer, laptop etc. (MAC-host) so that my iPad and other problematic devices will not be included decryption.

Btw: The DPI decryption should work. When i go to the "sophostest.com" site and click on the category "advertisements" the site will get blocked as aspected. The behaviour i was pointing out is just with advertisements in google search page etc. So i was wondering a little bit...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Rana Sharma over 5 years ago

Hi TheBalmasque,

Thanks for feedback.Sending you PM for more detailing.

Thanks,

Rana Sharma
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 TheBalmasque over 5 years ago in reply to Rana Sharma

I do some further investigations...

When i add a domain to the "local TLS exclusion list" i can now see advertisements on the page. In proxy mode the advertisements are always blocked... Even you put the site on the exclusion list for scanning, https... etc...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 TheBalmasque over 5 years ago in reply to TheBalmasque

Another update:

On the most web sites i recognize more advertisements not being blocked in DPI mode. In normal proxy mode most of the ads are blocked correctly.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Michael Dunn over 5 years ago in reply to TheBalmasque

There is a known issue with some policy enforcement with TLS 1.3.

Can you please go to

Rules and Polices, SSL/TLS Inspection Rules and click on SSL Inspection Settings.

Under TLS 1.3 can you select "downgrade to TLS 1.2 and decrypt".

Does that make a difference?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 TheBalmasque over 5 years ago in reply to Michael Dunn

Yeah it's better but not perfect compared to proxy mode. [:O]

EDIT: OK, i think it is better now. I needed to close the browser and start again...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel