I'm setting up a Sophos XGS and testing the Intrusion Prevention System. When I turn IPS on, some of our internal HTTPS sites stop loading or time out. The sites work fine with IPS off.
I thought IPS just inspected traffic. Why would it break secure sites? Is this a decryption thing, or a rule mismatch? In Salesforce or Zendesk, turning on a security feature usually just adds a step, it doesn't break things. What's different here?
Oh that's interesting! I've seen something similar with our web application firewall at work. The HTTPS breakage usually happens because the IPS is trying to inspect encrypted traffic it can't actually read. Without the right decryption certificates in place, it might be dropping packets it thinks are suspicious, when really it's just blind.
In my beginner's understanding, it's different from adding a step in Salesforce because the IPS is sitting in the middle of a secure handshake it can't fully see. Maybe check if you need to enable SSL inspection or add an exception for those internal sites? I'm still learning networking stuff though.
Have you checked the IPS logs to see what rule is triggering?
rookie