How to update default exclusions for Client DPI SSL manually in closed environments?

05/21/2020 2 2345

DESCRIPTION:

Since 6.5.2.x, the default common name exclusions for client DPI SSL is hosted on the cloud at mysonicwall.com. The firewall fetches the list from the cloud over a secure connection. It checks periodically for updates and download them upon availability.

RESOLUTION:

If you work in a closed environment or behind a proxy installation, these exclusions are supposed to be manually added on the firewall. The firewall will then calculate the run-time exclusion list by compiling new default white list with user-defined exclusions. 

You can use the following steps to import the list manually:

1. Login to https://mysonicwall.com and navigate to Product Management | My Products and select the Serial number for which you wish to import the list manually.
   
   
2. Expand the Manual Upgrade button and you would see the option to download the DPI-SSL Whitelist file.
   
   
3. Once you click on that link, it would download the file ‘Dpi-Ssl’ and you can save that on your computer locally.
4. Log in to the firewall UI and navigate to MANAGE | Decryption Services | DPI-SSL/TLS Client | Common Name tab.
   
   
5. If you scroll down on the page, you will see the section ‘Update Default Exclusions Manually’ where this file can be manually imported.
   
   
6. Click on the IMPORT EXCLUSIONS button and select the file downloaded earlier.
   
   
7. A warning message will pop up as below. Click on OK.
   
   
8. You would be able to see the built-in exclusions post that.
   
   

SonicWall keeps updating this list dynamically based on the feedback with respect to applications/URLs that fail with DPI SSL in place. Those get added to the default built-in exclusions as they are found to be incompatible.

NOTE: If you have a closed environment, it would be advisable to keep updating this list at regular intervals.

If you are not seeing the default exclusions hosted on cloud although the Internet connectivity is available on the firewall, you should check the connectivity to mysonicwall.com from INVESTIGATE | System Diagnostics | Check Network Settings tab as below