About clewis1

Hoping to get a little feed back regarding inbound ssl decryption.   We have beeing doing inbound ssl decryption to our public presense on version 8.0.7.   Things have been going realitivley well but I am running into some issues and not sure if I can fix it at the firewall level. Where I am running into issues is when we have multiple certs applied on a load balancer to a single ip which is behind the firewall.    example: ip address 1.2.3.4 (following sites all resolve to this ip this single ip addresss)   decrypt rule 1 = use cert on lb (wildcard cert *.domain.com) to 1.2..3.4 www.domain.com, bob.domain.com, ie.domain.com (all using *.domain.com) - decrpyting as expected no issue   decrypt rule 2 =  use cert on lb (*.domain1.com) to 1.2.3.4 domain1.com, cars.domain1.com - no decryption happening, traffic logs show session end reason of decrpyt-error, no url traffic logs (for https, if site is http url logs will appear as expected)- but I can get to the website as normal.    Also other sites (www.domain3.com, domain4,com, etc) on this  ip 1.2.3.4 with a different domain and no decrypt rule have same symptoms as decrypt rule 2.   My question is there a way to decrypt to a single ip using multiple certs? Also is there an explanation behind why https url logs do not show when decryption erros occur in traffic logs?   All testing has been completed with IE and Chrome   ... View more

Has anyone in an active/passive HA cluster experienced all urls logs being catergorized as 'not-resolved' after failing over to the passive box? We have had this happen multiple times now, to fix the issue we have re-download the seed database under Device -> Licenses    Running 8.0.6 currently, this had also been happening on 8.0.3.   I don't believe this is expected behaviour as it had never been an issue when we were in older vesrions.     ... View more

I am trying  to create a custom signature with the purpose of preventing malicious/phishing/spam emails with the firewall before it hits our mail gateway. For the most part we have been successful with this technique but I am struggling with creating a signature to essentially work as a wildcard. If anyone could take a look at my scenario and provide any feedback it would be much appreciated. Below is my example:   Scenairo: we are receiveing unwanted emais from the following email address scanner@abc.domain.com scanner@abcd.domain.com scanner@abcde.domain.com scanner@aaa.domain.com scanner@bbb.domain.com scanner@ccc.domain.com   As you can see the consistent parts of this type email campaign is the scanner @abc.domain.com. I am hoping to come up with a signature using email headers to wildcard the 'abc, abcd,abcda, etc'  as I dont want to be writing individual signatures for each sub domain as this could include upto 15 different representations of 'abc'.   I thought this would work scanner@(.*)(\.domain\.com) but does not appear to be the case. ... View more