Question with APP Patrol and SSL Inspection firmware V1.40(ABZI.0) USG Flex 700H

Options
YanShadowGT
YanShadowGT Posts: 33
First Comment Friend Collector Sixth Anniversary
image  Freshman Member
edited October 19 in USG FLEX H Series

I would like to know where I might be going wrong, as App Patrol does not function correctly when I enable SSL Inspection—it simply fails to detect the traffic. For example, while the content filter successfully blocks YouTube when SSL Inspection is active, App Patrol fails to detect it; consequently, the "reject" action I’ve configured in the policy is not triggered. This causes certain pages that embed YouTube content to get stuck in a loop or hang while waiting for a response—an issue that doesn't occur when App Patrol correctly rejects YouTube traffic. If I disable SSL Inspection, App Patrol is once again able to detect YouTube. Is this expected behavior, or is there an issue with my configuration?

image.png image.png image.png

Thank you for your help.

Update: I updated to the latest version, V1.40(ABZI.0), but the error persists. While you're at it, it would be helpful to have an option to filter out specific services from the logs—for instance, a way to select everything while excluding one particular service. Since I enabled SSL inspection, these logs keep appearing, even though I’ve configured both the Policy Control settings and the SSL inspection settings to exclude them. It’s quite frustrating to have so many log entries—for example, a certificate like Google’s, which is everywhere, shows up thousands of times. (This is the only configuration that allows SSL inspection to work alongside App Control.) Thanks for your help.

All Replies

  • YanShadowGT
    YanShadowGT Posts: 33
    First Comment Friend Collector Sixth Anniversary
    image  Freshman Member
    Options

    I just want to clarify that this isn't limited to YouTube—that was just an example. The same behavior occurs on other sites as well, though in general, it’s Google’s services that are present everywhere.

    Thank you for your help.

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,789
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    image  Zyxel Employee
    Options

    Hi @YanShadowGT ,

    when SSL Inspection is active, App Patrol fails to detect it; consequently, the "reject" action I’ve configured in the policy is not triggered. This causes certain pages that embed YouTube content to get stuck in a loop or hang while waiting for a response

    To better assist you and reproduce the issue, please let us know which certificate you selected on this screen.

    Cert_11.png

    Zyxel_Judy

  • kelmi
    kelmi Posts: 63
    First Comment Friend Collector Eighth Anniversary
    image  Ally Member
    edited October 22
    Options

    I was trying blocking Spotify in AppsPatrol. macOS Spotify application behavior is either blocked or allowed like AppsPatrol profile is configured with or without SSL inspection. I did not notice issues in 50H

    But interesting topic and I will follow this.

    Regards

    K

  • YanShadowGT
    YanShadowGT Posts: 33
    First Comment Friend Collector Sixth Anniversary
    image  Freshman Member
    Options

    Hi @Zyxel_Judy

    This is the certificate I use; I created one from scratch, and here is its information.

    image.png

    Thank you for your help.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）