Thread Info
  • State Suggested Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 8 replies
  • Answers 2 answers
  • Subscribers 5 subscribers
  • Views 13940 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HTTPS "URL filtering only" option enabled shows ssl warnings on all https websites or the page cannot be displayed after a while.

Stephan Stoke

Enviroment: HOME
sophos UTM 9.506-2 on Hyper-V.
UTM is behind NAT
Sophos UTM upgraded from 9.505-4 to 9.506-2

9.505-4: no problem
9.506-2: webfilter problem (see below)

Problem: HTTPS "URL filtering only" option enabled shows ssl warnings on all https websites or the page cannot be displayed after a while.
It looks like when using two networks in one and the same default webfilter profile the problem occurs.



Problem is resolved when: "Do not proxy HTTPS traffic in transparent mode" is enabled
Problem is temporary resolved when: UTM is rebooted (but after a while the problem is back again and HTTPS sites shows unsafe SSL warning)

Problem is solved for good when two seperated Web Filter Profiles are created for each network:



Can somebody tell me why this is happening? Thanks!

Regards, Stephan



This thread was automatically locked due to age.
Parents
  • 0

    About the S.S.L. warnings:

    To display a block or warn message, UTM has to impersonate the target server -- no other option.   This means that you need to distribute the proxy ca certificate even if you had not intended to do https decrypt-and-scan.   But once it is distributed, you might as well do https inspection as well.

    The warnings indicate that it has not been pushed out to your clients.

    The need for two profiles  is harder for me to explain.   But it is best to have a separate profile for each security zone.     If you need to restrict traffic from crossing from zone 1 to zone 2, this goes in the filter action website block list for zone 1.

Reply
  • 0

    About the S.S.L. warnings:

    To display a block or warn message, UTM has to impersonate the target server -- no other option.   This means that you need to distribute the proxy ca certificate even if you had not intended to do https decrypt-and-scan.   But once it is distributed, you might as well do https inspection as well.

    The warnings indicate that it has not been pushed out to your clients.

    The need for two profiles  is harder for me to explain.   But it is best to have a separate profile for each security zone.     If you need to restrict traffic from crossing from zone 1 to zone 2, this goes in the filter action website block list for zone 1.

Children
No Data
Unfiltered HTML