Firewall SSL encryption issues accessing phone apps through wifi

[Carrot63]

Hi

We are with EXA networks and have a Stormshield firewall managed by them as part of the agreement. On the wired network everything is absolutely fine. We have however had many issues on the wireless network because of ssl encryption. We have a realtime monitor that can sometimes help to identify a url that needs allowing through the firewall to enable apps to work but it rarely shows any issues. When this happens we have to contact exa and they can inspect it in more detail and sometimes find the issue, put it in the exception list and all is well with that app.

 

We are finding more and more issues though and they are not being resolved. Our current main problem seems to be anything google related. At present we are struggling with the play store and maps. We are told that it is because google keep changing things and obviously you can't just allow google.com through the firewall as although that does resolve all of the issues it then opens us up to being able to type anything into google search engine and see pretty much anything!

 

I know that these ssl problems are current issues that lots of people are experiencing but I just can't believe that each school has to jump through the same hoops to try and work out what to exclude just so they can have a good wifi experience. Are these issues handled more easily with smoothwall/Sophos XG etc..?

 

Does anybody have the lists of exceptions required for google maps and the play store?

 

Do other EXA network users experience the same issues?

 

We have very good Meraki wifi coverage at school but because of the ssl encryption issues all I hear from many staff and pupils is that we have "rubbish wifi". The ones who persevere and come to see me so that we can find exclusions to their problem apps are happy with their wifi experience but many people just are not prepared to spend the time getting it resolved as they think it should "just work" like it does at home or in cafes etc..

 

How do you all overcome these issues? I appreciate that some people do not use ssl encryption for their wifi and certainly if we did bypass it then we would have a much more satisfactory wifi experience however we are not happy that this covers our safeguarding responsibilities satisfactorily so will not do this.

 

Any suggestions/advice gratefully received.

 

Thanks

[Jcx500]

Do they provide a different proxy which bypasses ssl inspection? this is how i do it

[Carrot63]

I can bypass ssl inspection but I do not want that as I would be concerned about the safeguarding aspect.

Thanks

[free780]

Unfortunately Google are very anti. SSL Interception so if you choose Gsuite as your platform you need to Bypass interception for Google domains. Also newer versions of android block interception certificates.

[Carrot63]

Hi

 

At present support have said that the solution would be to move to Quantum as we are still on Fusion. Could anybody who has Quantum confirm for me please whether Playstore and Google maps are able to work without having to allow google.com through?

 

Thanks

[Opendium_Steve]

We are finding more and more issues though and they are not being resolved. Our current main problem seems to be anything google related. At present we are struggling with the play store and maps. We are told that it is because google keep changing things and obviously you can't just allow google.com through the firewall as although that does resolve all of the issues it then opens us up to being able to type anything into google search engine and see pretty much anything!

 

Google have a couple of problems:

1. They have a habit of mixing lots of different services on the same (sub)domains.

2. They are very anti-HTTPS decryption and a lot of their stuff is expressly designed to break if you try decrypting it.

 

So, for example, they have Play related stuff on the same hostname as random other user-generated content (including porn) from other Google services. And Play is designed to break if you decrypt HTTPS, so you have to make a choice between Play working or being able to block or report on accesses to the porn that's hosted in on the same hostname. At the moment, the best we've managed to do is have Play work ok except for some graphics not displaying, whilst maintaining the ability to block/report the inappropriate content.

In 2016, Google made a concious decision to break HTTPS decryption on Android:

https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html

We've tried to discuss the issue with them, as have a number of other filtering providers and, I believe, the Home Office have too. Google just aren't interested in even discussing the problem. We currently advise schools not to purchase Android devices, as we don't think you can meet the statutory safeguarding requirements if you don't do HTTPS decryption (in particular, you can only block about 21% of the radicalisation content on the the CTIRU blocklist if you're not decrypting, and similar things can be said about the IWF block list!). Obviously this is a big problem for BYOD where you don't get to choose what devices people bring in.

 

There are several Android bugs open relating to these problems:

https://issuetracker.google.com/issues/124654196

https://issuetracker.google.com/issues/122796442

https://issuetracker.google.com/issues/122796443

 

This was discussed at length in the CTIRU conference last autumn, but with no real progress being made - I wrote up a report on the conference, but unfortunately I'm not allowed to link to it on EduGeek, so you'll have to Google for it if you're interested.

 

A real problem is that some non-search related stuff is hosted at w w w . g o o g l e . c o m, where turning off decryption is obviously not an option. I'm afraid you just have to live without that stuff for the most part. Google are unfortunately big enough to basically back everyone into a corner and say "tough" instead of listening to people and trying to fix the problems they are creating.

 

I know that these ssl problems are current issues that lots of people are experiencing but I just can't believe that each school has to jump through the same hoops to try and work out what to exclude just so they can have a good wifi experience. Are these issues handled more easily with smoothwall/Sophos XG etc..?

 

I think whatever filter you're using, its very much a whack-a-mole situation. When you find an app that's broken, someone has to look at the app itself and decide whether it is going to cause safeguarding concerns, and also look at its traffic and figure out if turning off decryption for that traffic would cause unrelated safeguarding problems. Hopefully, each time someone jumps through those hoops your filtering provider rolls out the update for everyone so that all their customers benefit.

 

Although, pushing out updates is a problem in itself - what happens when your filtering provider "fixes" an app that you were quite happy with being broken?

 

How do you all overcome these issues?

 

The only thing I can suggest really, is to have a good relationship with your filtering supplier and make good use of their support people to help with this stuff. But be aware that with all the good will in the world from your filtering supplier, there are some things that can only truly be fixed by the third parties (e.g. app and operating system vendors) who have no interest in fixing them. We've got quite good at thinking up cunning work-arounds to some of the problems though.

 

Also, try to have a good idea of what the main problems are at any given time - vague reports like "users are complaining that some apps aren't working" are pretty unhelpful, whereas "we need specific apps X, Y and Z to work" are much more likley to result in a positive outcome.

Edited March 6, 2019 by Opendium_Steve

[Carrot63]

Hi

Thanks Steve for that very thorough and useful information. Glad I am not the only one with issues. Fortunately our ISP are very helpful and do try to help us find solutions to the problems, it just feels that trying to get apps working is a never ending issue.