LevelBlue Knowledge Base

KB Home Search Latest Additions Most Popular

Knowledgebase

Home » Knowledgebase » Legacy Products » Web Filter (R3000) » HOWTO: Why do we have Https slippage

HOWTO: Why do we have Https slippage

Show/Hide Article Tools

This article applies to:

WF /WFR 4.1.10 or 3.0.10 and up

Question:

It seems for every site in the categories, if a person changes the URL from HTTP:// to HTTPS://, it will allow the site to come through unblocked.

Procedure:

TWO REASONS THIS MAY HAPPEN:

1. The filter redirects to an IP address not in the filter, a realtime probe would help find the ip or nslookup of the domain. Sometimes a login page is encrypted and the filter see's this as a man in the middle and block it. Just add the ip to a custom allow page and set to allow in the profile after a library reload.

2. We have found out this is a configuration issue, if the security settings are not in place, any browser will bypass as well.Go to System>Contol>Filter and make sure Pattern blocking is on and HTTPS is on medium with forward dns checked.You may experience overblocking with this setting, and it will take a while to whitelist legitimate sites as they come in from end users. Running a real-time probe will show the reason for this and it's usually blocked by moderate HTTPS. To whitelist that site, just add the ip address to a passed custom category and reload the library.

To contact LevelBlue about this article or to request support:

Create a case through the Fusion portal (U.S. Government customers, use the TGS Fusion portal).
Call us on a local phone number.

Rate this Article:

Add Your Comments

Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster.

Execution: 0.040. 9 queries. Compression Disabled.