Can SWG Block an HTTPS address?
|Article:TECH98131|||||Created: 2009-01-16|||||Updated: 2011-09-23|||||Article URL http://www.symantec.com/docs/TECH98131|
You want to know if SWG is able to block HTTPS sites
You configure a policy to block an HTTPS site by Domain name or IP Address but the policy does not work.
SWG 4.5.x or later handling HTTPS traffic via Inline mode (the embedded proxy available from SWG version 5.0 is not being used)
If the browser is not going through a proxy, when accessing an HTTPS website, the data (including URL) is encrypted and therefore SWG will not "see" the URL and apply the policy.
If you configure the browser to go through a proxy, the URL will not be encrypted and SWG will then be able to block HTTPS web sites.
Under certain scenarios, HTTPS websites will be blocked but the SWG blocking page will not be displayed. A browser error will be displayed instead. The type of error will depend on the browser. This is expected when an attempt to hijack* an HTTPS session occurs and therefore a limitation of the Inline Mode.
* The redirection to the SWG blocking page uses the session hijacking method to work.
- SWG 5.0.x and later offers a proxy mode that is capable of monitoring and blocking HTTPS URLs.
Article URL http://www.symantec.com/docs/TECH98131