topic Re: Type=Deny while Action=Allow in General Topics

Type=Deny while Action=Allow

Hwinter — Fri, 21 Apr 2017 17:26:15 GMT

When opening iOS Facebook app I''m unable to play a movie... however, from the same device if I login to facbook via browser I can play the video.

I'm trying to find out why the iOS App is getting blocked, as my policies clearly allow it.

Rule iPhones:

Iphone Rule allowing all traffic

Log when using Facebook via Chrome

Log when using Facebook via iOS App

Decryption Policy

I'm not sure what I'm missing here. I'm trying to understand what is causing the traffic to be blocked. The only thing I see different is the fact that when the user is using the App PA shows the traffic as SSL and when using the Chrome PA shows it as facebook-Video. However, both should be allowed.

Any ideas? I'm running VM-100 on 7.1.9.

Thanks!

Re: Type=Deny while Action=Allow

Hwinter — Fri, 21 Apr 2017 19:17:13 GMT

For what is worth, I went to Device tab > Response Pages screen, I unticked the "Enable SSL Opt-out Page" option. After that, it looks like it is working.

Response Page

So I believe the page was sent to the app and it was timing out as there would beno reply. Not exacly what I was execting, but that is the only explanation on my mind.

UPATE: problem still presists. VIdeo must have been cached when I was testing it.

Re: Type=Deny while Action=Allow

MangoTango — Mon, 24 Apr 2017 20:17:39 GMT

I saw the same behavior. When I ran a packet capture on the traffic, I noticed the client was unable to validate the certificate and closed the connection. The traffic had to be exempted as I couldn't include the Decryption CA root in the application's trusted certificate store.

Re: Type=Deny while Action=Allow

Hwinter — Mon, 01 May 2017 13:08:25 GMT

In my case the application was not identified when using the Facebook App (shows just SSL). Interesting enough, when using Chrome one the iPhone, it identifies it as Facebook-Video. So I had to create a rule to exempt any Social-Network category for iPhones, which isn't ideal, but it was the lowest denominator. Otherwise I have to exclude iPhone from decryption all together or at least iPhones SSL.

Re: Type=Deny while Action=Allow

Kristine.Kartchner — Tue, 30 Apr 2024 14:12:42 GMT

How did you exempt the traffic? The rule looks like it should have exempted it already. Do you mean you do not decrypt?