Can SWG Block an HTTPS address?

Products

• Web Gateway

Issue/Introduction

You want to know if SWG is able to block HTTPS sites

You configure a policy to block an HTTPS site by Domain name or IP Address but the policy does not work.

Example:

https://www.facebook.com  and https://66.220.149.18 will NOT be blocked but http://www.facebook.com would be blocked if the policy is set to block www.facebook.com.

 

Cause

If the browser is not going through a proxy, when accessing an HTTPS website, the data (including URL) is encrypted and therefore SWG will not "see" the URL and apply the policy.

Resolution

If you configure the browser to go through a proxy, the URL will not be encrypted and SWG will then be able to block HTTPS web sites.

Under certain scenarios, HTTPS websites will be blocked but the SWG blocking page will not be displayed. A browser error will be displayed instead. The type of error will depend on the browser. This is expected when an attempt to hijack* an HTTPS session occurs and therefore a limitation of the Inline Mode.

Notes:

* The redirection to the SWG blocking page uses the session hijacking method to work.

• SWG 5.0.x and later offers a proxy mode that is capable of monitoring and blocking HTTPS URLs.

Applies To

 SWG 4.5.x or later handling HTTPS traffic via Inline mode (the embedded proxy available from SWG version 5.0 is  not being used)