detect_protocol(no) rule does not work for sites or applications when applied in the VPM

Products

• ProxySG Software - SGOS

Issue/Introduction

When applying the rule Disable SSL Detection from within the VPM you are simply disabling the detection of SSL encrypted traffic over a non-standard port. The Edge SWG (ProxySG) will still attempt to detect other protocols. 

• If you have an application that uses standard ports for non-standard communication (such as MS Lync), you may need to disable Protocol Detection altogether.
  • You can disable Protocol Detection as a global setting on the Edge SWG (ProxySG) through Service Group configuration, however this will impact all traffic including any SSL encrypted sites over port 80.  
• To do this as an exception rule you will need to add a CPL layer, or modify the Local Policy on your Edge SWG (ProxySG) with a rule based on the source or destination.

For example:

By URL

<proxy>
url.domain=example.com detect_protocol (none)

By destination IP Address

<proxy>
url.address=#.#.#.# detect_protocol (none)

By User Agent

Not all applications report a User-Agent so this may not be an option for all scenarios.

<proxy>
User-Agent="application-specific-agent-name" detect_protocol (none)

If you have multiple URLs, IP addresses, or User-Agents that require this rule, or if you would like to learn more about the detect_protocol property, please refer to the Content Language Policy Guide. It provides detailed instructions on how to create "Condition" rules to encompass multiple objects within a single rule.

Resolution

.