How to Configure DPI-SSL CFS Category-based Exclusions / Inclusions (SonicOS 6.2.5.x)

10/14/2021 141 13750

DESCRIPTION:

RESOLUTION:

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

1. Log in to the SonicWall management portal
2. Navigate to the Deep packet Inspection | SSL Client deployment  page.
3. Click on the CFS Category-based Inclusion/Exclusion tab
4. Under Content Filter Category Inclusions/Exclusions, select either Exclude or Include. By default Exclude is selected. For this article, we go with the default.
5. In the Category list, select the category that has to be included for or excluded from DPI-SSL inspection. Note: For this article, the categories 20 (Online Banking) and 21 (Online Brokerage and Trading) and 26 (Health) are selected for exclusion.
6. Click on Accept at the bottom to save the settings

NOTE: Selecting either category 20 or 21 will automatically result in selection of the other, ie: categories 20 and 21 go hand-in-hand. 

 We have selected categories 20,21 and 26 for exclusion. All other categories are included for DPI-SSL inspection. We now add sites that needs to be excluded from DPI-SSL inspection although their associated category is set for inclusion. 

1. Navigate to the Common Name tab
2. Under View Style, select Custom
3. Click on the Add button
4. In the Add Common Names window, enter Common Names of the sites to be excluded.
5. Set Action to Exclude
6. Enable the check-box, Always authenticate server before applying exclusion policy. 
7. Click on OK 

Now we add websites which must be included for DPI-SSL inspection although their associated category is set to exclude. 

1. Click on Add again
2. Enter Common Names of the site you wish to include. 
3. Set Action to Skip CFS Category-based Exclusion
4. Click on OK

We now enable SSL Client inspection.

1. Navigate to the General tab
2. Enable the following check-boxes:
   1. Enable SSL Client Inspection
   2. Content Filter
   3. Always authenticate server for decrypted connections (recommended)
   4. Always authenticate server before applying exclusion policy (recommended)
3. All other option could be left at default.
4. Click on Accept at the top to save the settings.

Testing

From a host behind the SonicWall, perform the following tests:

• Go to https://online.citi.com. Click on the lock icon and make sure the certificate is issued by a public CA 
• Test other banking or health related websites and they must show their certificates as issued by a public CA
• Go to https://www.wellsfargo.com. Click on the lock icon and the certificate should show that it has been issued by SonicWall Firewall DPI-SSL CA. 
• Do the same for https://www.healthcare.gov
• Go to https://mail.google.com. The site must show its certificate as issued by a public CA. 
• Go to other websites excluding the above and all must show the certificates issued by SonicWall DPI-SSL CA. 

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

1. Log in to the SonicWall management portal
2. Navigate to the DPI-SSL | Client SSL page.
3. Click on the CFS Category-based Inclusion/Exclusion tab
4. Under Content Filter Category Inclusions/Exclusions, select either Exclude or Include. By default Exclude is selected. For this article, we go with the default.
5. In the Category list, select the category that has to be included for or excluded from DPI-SSL inspection. Note: For this article, the categories 20 (Online Banking) and 21 (Online Brokerage and Trading) and 26 (Health) are selected for exclusion.
6. Click on Accept at the top to save the settings

 NOTE: Selecting either category 20 or 21 will automatically result in selection of the other, ie: categories 20 and 21 go hand-in-hand. 

 We have selected categories 20,21 and 26 for exclusion. All other categories are included for DPI-SSL inspection. We now add sites that needs to be excluded from DPI-SSL inspection although their associated category is set for inclusion. 

1. Navigate to the Common Name tab
2. Under View Style, select Custom
3. Click on the Add button
4. In the Add Common Names window, enter Common Names of the sites to be excluded.
5. Set Action to Exclude
6. Enable the check-box, Always authenticate server before applying exclusion policy. 
7. Click on OK 

Now we add websites which must be included for DPI-SSL inspection although their associated category is set to exclude. 

1. Click on Add again
2. Enter Common Names of the site you wish to include. 
3. Set Action to Skip CFS Category-based Exclusion
4. Click on OK

We now enable SSL Client inspection.

1. Navigate to the General tab
2. Enable the following check-boxes:
   1. Enable SSL Client Inspection
   2. Content Filter
   3. Always authenticate server for decrypted connections (recommended)
   4. Always authenticate server before applying exclusion policy (recommended)
3. All other option could be left at default.
4. Click on Accept at the top to save the settings.

Testing

From a host behind the SonicWall, perform the following tests:

• Go to https://online.citi.com. Click on the lock icon and make sure the certificate is issued by a public CA 
• Test other banking or health related websites and they must show their certificates as issued by a public CA
• Go to https://www.wellsfargo.com. Click on the lock icon and the certificate should show that it has been issued by SonicWall Firewall DPI-SSL CA. 
• Do the same for https://www.healthcare.gov
• Go to https://mail.google.com. The site must show its certificate as issued by a public CA. 
• Go to other websites excluding the above and all must show the certificates issued by SonicWall DPI-SSL CA.