DLP with HTTPS

[Dipen]

We have created a DLP Filter to block EXE Files. It is working with HTTP Sites however download of exe' s still happening from HTTPS Sites. Same issue like WebFilter.

[netmin]

This is because DLP attempts to intercept HTTP GET and/or HTTP POST traffic, which is not visible to the sensor without performing deep ssl-inspection.

[Dipen]

So DLP dosent work independent of Web Filter as we define Deep Inspection Scan in Web Filter Policy.

[cdiaz]

Then ?? all https traffic is " free" for users??

[jorge9090]

If the traffic is encripted in a SSL Tunnel, you need to enable SSL inspection, otherwise the FGT doesn' t know whats inside the tunnel and can' t block it. This applies to Web Filter, DLP and APP Control.

[hklb]

DLP is not dependant of web filter. You can create a firewall rules without web filter, but DLP enabled. If you want to enable DLP, you need : - a proxy profile with correct parameters - DLP profile - DPI if you want to scan encrypted flow (SMTPS, HTTPS, ...) DPI is not only for the web filtering, it is a security feature to improve the efficiency of all other feature (IPS, app control, web filter, dlp, AV, ..)

[cdiaz]

hklb, you said I need a " proxy profile" . Why? I didn' t see it at documentation. the device use v.5.0 thanks

[Adrian_Buckley_FTNT]

Are you trying to mix flow and proxy based UTM profiles? If so, don' t do that. Use all flow or all proxy based. Logic was added regarding this in 5.0.5

[cdiaz]

I was doing any test with DPI active: URL web filter works well and i can filter https web sites, but with DLP with file type and file size sensor it didn' t log any file I download from https site. I' m sure DLP is not in flow mode. Web filter is done with the URL filter with wild card. Thanks

[Adrian_Buckley_FTNT]

What firmware version are you using?

DLP over HTTPS is broken in early versions of 5.0