What does the property tunnel enabled mean?

[fw_mon]

I have many connections marked with Tunnel.Enabled "true" even if I haven't enabled "HTTP Tunnel".  Is this property even related to this event? What does this property exaclty mean?

The Enable HTTP Tunnel event described here, so there are no questions on this event.

[mkutrieba]

Hello,

I did a test and only get this Tunnel.Enabled = True if I use "Enable HTTP Tunnel" event. Once I disable this rule I get "False". Did few tests with/without HTTPS Scanning, with/without bypass for HTTPS Scanning and I only got "True" when I used this event.

Maybe check policy if this is used somewhere else? Maybe also interesting to know which connections are running in, maybe a lot traffic from user is hitting such a rule based on used criteria.

[fw_mon]

hm, I got Tunnel.Enabled=true with the default ruleset (HTTPS Scanner disabled).

Steps to reproduce:

1. fresh install 10.x

2. add to access.log Boolean.ToString (Tunnel.Enabled)

3. visit a https site

4. get true in log

[mkutrieba · Accepted solution]

Hi,

Sorry have to correct myself, this tunnel enabled = true stands for HTTPS scanning done or not. If not, it is tunneled as MWG does not look inside the connection. Not sure what went wrong in my first test.

You are right, a default policy with SSL scanner disabled shows tunnel enabled = True because MWG does not inspect the HTTPS traffic.
I did a test with default policy and SSL scanner enabled and got "False" (so HTTPS traffic inspected), did another test with bypass rule for SSL scanner only and got "True" (HTTPS traffic bypassed from inspection).

Same can be seen in mwg-core -S connections output:
1) With SSL Scanning: SSLHandling | 713 | https://www.mwginternal.com
2) With bypass for SSL Scanning: TunnelData | 0 | https://www.mwginternal.com

[fw_mon]

Thank you for the clarification