Adding websites to the Incident List

Use Configure > SSL > Incidents > Add Website to specify sites that you want to allow, blacklist, or tunnel. Sites that are added manually are assigned chronological Ticket IDs. These appear on the Incident List. See Viewing incidents.

Enter the URL of the site you are adding to the Incident List.


	Note When specifying an IPv6 address, do not enclose the address in square brackets ([]).

Select either By Certificate or By URL.

By Certificate provides greater security. If you add a site by certificate, clients cannot bypass the policy by using the IP address rather than the URL. When you select By Certificate, Content Gateway retrieves the server certificate and adds the site to the Incident List. See Viewing incidents.

If sites are blocked by certificates, wildcard certificates are not accepted, even if the common name is recognized.

Select By URL to tunnel, allow, or blacklist the site.

In the Action drop-down list, specify if the site should be added with Tunnel, Allow, or Blacklist status. See The incident report for details.

Tunnel: (Valid for By URL only) The site is tunneled. Traffic is not decrypted and Content Gateway does not check the certificate.

Important

Tunnel by URL does not work for all transparent proxy requests.

It works under these conditions:

When the client application uses TLS and includes an SNI (server name indication), Content Gateway checks the Incident list for the hostname in the SNI.

When there is no SNI, Content Gateway connects to the origin server to retrieve the certificate. If the Common Name is a unique FQDN, Content Gateway looks it up in the Incident list. If the Common Name contains a "*" (wildcard), or is not a unique FQDN, Content Gateway looks for the IP address in the Incident list.

Alternatively, use ARM Static bypass rules.

Allow: Users can access the site even if the certificate is not valid. Traffic is decrypted, and certificate checking is disabled.

Blacklist: The site is completely blocked. Users cannot access this site even if the Verification Bypass is configured.

Click Apply.

It is recommended that you manually add sites to the Incident List after you have monitored your network traffic for a period of time with the CVE disabled. (See Configuring validation settings.) This enables you to improve performance by tunneling trusted sites and blocking those you know should not be accessed. See The incident report for information about assigning a status, such as tunneling, to a site and incident.