XG v18 - Firewall FQDN fail to match if domain match web exception - Yet Another Bug

Question

Firewall FQDN fail to match if domain match web exception 
 Duplicate 
 Create FQDN Firewall rule. Surf to FQDN and watch traffic hit rule. 
 Add a web exception with Matching URL regex and skip all. 
 Surface to FQDN again and watch it the firewall rule, confirm with firewall logs.

LuCar Toni · Accepted Answer

Web Exclusions will be applied to DPI, if possible. Currently we think around 90% of the web traffic can be applied to the exclusion. 
 The reason is, any product can only decide, if it want to break the TLS within the first packet of TLS. Thats the TLS Syn in the handshake. See: https://tls.ulfheim.net/ 
 The Client "can" put a SNI into the helo. So to speak, you can say, give me the connection of ring.com. But you do not have to do this, its optional. 
 So if the client is not doing this, we cannot apply the web exception. Because later in the stream, you cannot go and undo the decryption. Thats your only chance to apply decryption based on this first packet.

https://community.sophos.com/xg-firewall/f/recommended-reads/122357/life-of-a-packet---sophos-xg-v18-0 
 
 So lets paint the picture: Your Connection will come and hit, based on the first matching firewall rule. Seems like this can be #2, as it has some bytes on it. This firewall rule will forward this connection to DPI to decrypt or not. DPI may not be able to find a exclusion, as the SNI may not be there. So it will start to decrypt, which leads to a faulty connection. 
 
 Does this make sense?

LuCar Toni · Answer

Actually, if i can follow your request, this is not a Bug at all. 
 Firewall Rules have nothing to do with a Web Exception. 
 See: https://community.sophos.com/xg-firewall/f/recommended-reads/122357/life-of-a-packet---sophos-xg-v18-0 
 Basically the Web Module exception will only be called, if the web proxy is enabled for this firewall rule. The firewall rule will hit, no matter what (first match). 
 
 So maybe i do not understand your issue, it would be better to explain it with more screenshots.

XG v18 - Firewall FQDN fail to match if domain match web exception - Yet Another Bug

Top Replies