OPERATIONAL DEFECT DATABASE
...
...
When WebBlocker is configured on a cloud-managed Firebox to filter web traffic, users might see a connection error in the browser when WebBlocker blocks outgoing HTTPS traffic, instead of the WebBlocker deny page. This behavior is caused by how a cloud-managed Firebox detects website categories. The categorization of the website URL domain is blocked during the TLS key exchange. This means that the deny occurs before the browser sends the HTTP request, which prevents the Firebox from showing the WebBlocker deny message in the response.
To display the WebBlocker deny page to the user, you must configure a combination of two settings on your cloud-managed Firebox: On the Firewall policy that handles the connection, in the Traffic Types section, enable Decrypt HTTPS Traffic. TLS decryption is required to insert the WebBlocker deny page into the established HTTPS connection. For more information, see Configure Traffic Types in a Firewall Policy in Help Center.On the Content Filtering action, enable the WebBlocker Override feature. When WebBlocker Override is enabled, it disables the domain check on the TLS key exchange. This allows the browser to send the full outgoing HTTP request that enables the Firebox to respond with the WebBlocker deny page. For more information, see WebBlocker Override in WatchGuard Cloud in Help Center. NOTE: This Known Issue was resolved on 13 February 2025. The update to WatchGuard Cloud on 13 February 2025 updated how policies with Decrypt HTTPS Traffic enabled handle user requests. When WebBlocker is configured on a cloud-managed Firebox to filter web traffic, outgoing HTTPS requests that pass through web policies with Decrypt HTTPS Traffic enabled now correctly show the WebBlocker deny page to users. For policies created before 13 February 2025, this resolution will be effective after your next configuration deployment in WatchGuard Cloud.If you enabled WebBlocker Override on any policies as a workaround to this issue, you can now disable it.
Click on a version to see all relevant bugs
WatchGuard Technologies Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.
