How should I repair a firewall that cannot process HTTPS addresses?

How should I repair a firewall that cannot process HTTPS addresses?

Our Internet network uses a Zywall70 firewall to filter gambling, pornographic, chat and other non-business sites. I found that this firewall cannot filter or log the sites whose address begins with HTTPS. How should we fix this, if the firewall is in fact the reason why it's not working properly?

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

It sounds like your firewall is not performing HTTPS proxying. The difference between HTTP and HTTPS, of course, is that HTTPS traffic is encrypted when passed over the network. If HTTPS proxying is not in use, the firewall cannot decrypt the contents of the HTTPS session. Since it cannot read the URL from the encrypted network stream, it is not possible for the firewall to perform content filtering on the connection. It's not a problem with your firewall; it's the desired behavior of HTTPS, since such a protocol prevents eavesdropping.

If you must perform content filtering on encrypted traffic, you have a couple of options. You may wish to consider partially or fully blocking HTTPS traffic with your firewall, limiting the traffic to business-critical uses. Alternatively, you can set up an HTTPS proxy server for your organization and use it to implement content filtering.

This was first published in September 2006

Back to top