Can SWG Block an HTTPS address?

Article:TECH98131

Created: 2009-01-16

Updated: 2011-09-23

Article URL http://www.symantec.com/docs/TECH98131

Article Type
Technical Solution

Product(s)

Show all

Languages

Show all

Problem

You want to know if SWG is able to block HTTPS sites

You configure a policy to block an HTTPS site by Domain name or IP Address but the policy does not work.

Example:

https://www.facebook.com and https://66.220.149.18 will NOT be blocked but http://www.facebook.com would be blocked if the policy is set to block www.facebook.com.

Environment

SWG 4.5.x or later handling HTTPS traffic via Inline mode (the embedded proxy available from SWG version 5.0 is not being used)

Cause

If the browser is not going through a proxy, when accessing an HTTPS website, the data (including URL) is encrypted and therefore SWG will not "see" the URL and apply the policy.

Solution

If you configure the browser to go through a proxy, the URL will not be encrypted and SWG will then be able to block HTTPS web sites.

Under certain scenarios, HTTPS websites will be blocked but the SWG blocking page will not be displayed. A browser error will be displayed instead. The type of error will depend on the browser. This is expected when an attempt to hijack* an HTTPS session occurs and therefore a limitation of the Inline Mode.

Notes:

* The redirection to the SWG blocking page uses the session hijacking method to work.

SWG 5.0.x and later offers a proxy mode that is capable of monitoring and blocking HTTPS URLs.

Legacy ID

2009121609094654