On Tuesday 04 January 2022 at 01:19:28, Will BMD wrote: > Hey all, > > I currently have the following network topology, it's emulating a real > world environment. The proxy is running ssl_bump. > > LAN <-> Squid Proxy <-> Firewall <-> Internet > > From the Firewall's perspective all client connections are originating > as the proxy server.
Okay, that makes good sense. > We're wanting to use the https inspect feature of the firewall, Please give more details? - What sort of firewall is this? - What does "HTTPS inspect" actually mean? - How does the firewall "inspect" HTTPS traffic, which by design is encrypted between client and server (neither of which is the firewall)? - What does "inspect" mean? What information is revealed from the inspection of the encrypted communication? > but according to our firewall documentation it appears due to the location of > our proxy servers we would be unable to do so. Why? Where would the proxy servers need to be instead, in order for this inspection to work? Alternatively, how does/would it work if the proxy were not there, and clients communicated directly to the Internet through the firewall? > My question is, if the proxy is behaving as a MITM between itself and > the client, can't the Firewall do the same thing between itself and the > proxy? I agree. Have you asked the suppliers / authors / vendors of the firewall? > I suspect it is possible, but might potentially involve a lot of headaches > and a big hit on performance? Who knows? If it's the firewall telling you there's a problem, this doesn't entirely feel like a Squid question. Antony. -- If you can smile when all about you things are going wrong, you must have someone in mind to take the blame. Please reply to the list; please *don't* CC me. _______________________________________________ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users