XG Firewall version 18 offers a new and powerful way to filter web traffic and
perform SSL inspection on encrypted web payloads. In this short video we will
compare the new dpi based filtering with the legacy web proxy, explain why you
might want to use one, over the other and show you how to control which is used in
policy configuration. We will start by looking at the differences between dpi
and web proxy filtering. DPI implements proxy-less filtering handled by the IPS
engine. It provides port agnostic protocol detection and supports the
partial or full offload of traffic flows to the network fast path. It can decrypt
and scan TLS 1.3 traffic and offload to the traffic trusted by Sophos labs. In
comparison you may want to use the web proxy filtering to enforce safe search
or YouTube restrictions, or because your clients are configured to use the XG
firewall as an explicit proxy. Let's take a closer look at how the traffic is
processed in each of these scenarios.
With the dpi engine and separate SSL TLS inspection rules, the controls available
in the web filtering section have changed. Using the configuration shown
here, all of the traffic will be handled by the new faster dpi engine for IPS, and
proxy less web filtering, and SSL decryption on any port, HTTP and HTTPS
using port agnostic protocol identification. In this configuration the
SSL TLS inspection rules are used to manage the decryption of secure web
traffic. Using the dpi engine allows the XG firewall to offload safe traffic to
the fast path. This is dump traffic that the XG firewall qualifies as being safe,
or that matches identities for Sophos labs trusted traffic. If you enable the
web proxy, then HTTP and HTTPS traffic on port 80 and 443 will be processed by the
legacy web proxy for decryption, web policy, and content scanning before being
handed to the DPI engine for application control and
IPS. HTTP or HTTPS traffic on other ports will still be handled by the DPI engine.
The legacy web proxy is also used in explicit proxy configurations. When the
web proxy is being used, none of the traffic can be offloaded to
the fast path. This includes any traffic that matches identities for Sophos Labs
trusted traffic. Let's have a look at the configuration in the XG firewall. You can
select between using dpi based web filtering or the existing proxy based
web filter retained from version 17.5, existing installations upgraded from
version 17.5 to version 18.0 and still perform the web filter with the existing
implementation, and can be switched over to using the dpi filtering later if
desired. So in the XG firewall from the control center navigate to rules and
policies in the left-hand menu. Select to add a new firewall rule and give it a
name. Select the action to accept and fill in the necessary parameters of the
firewall rule. Now let's focus on the web filtering section. In the web policy
column start by selecting a web filtering policy from the drop down menu.
If you see the warning message this policy includes options that can be
enforced by the web proxy only, it indicates that the policy is configured
with a setting that is not supported by the DPI engine. For example this would
include SafeSearch enforcement, YouTube restrictions or if you would like to use
farming protection, for these use cases you will need to use the traditional web
proxy. In the content scanning column you can enable malware scanning options in
much the same way as in version 17.5. The new a proxy column of options controls
whether it is the DPI engine or web proxy that would form the filtering. By
default in a new firewall rule the DPI engine will be used, as these options are
not selected. By selecting use the web proxy transparently to scan traffic on
port 80 and 443, HTTP and HTTP sessions on port 80 and 443 will be
processed by the web proxy, and will not be submitted to the DPI engine. Use the
option decrypt HTTP traffic scan by the web proxy to perform decryption of HTTP
traffic on port 443, or any other custom port you have configured, or the direct
proxy mode. To conclude, the new DPI engine is able to protect HTTP and HTTPS
traffic on any port using protocol detection, and most importantly it makes
use of fast path uploading, which improves performance. However, you may
still want to use the legacy web proxy to enforce safe search or YouTube
restrictions, or because your clients are configured to use the XG firewall as
an explicit proxy. Thank you for watching