> Source: [sk64166](https://support.checkpoint.com/results/sk/sk64166)

# sk64166 - HTTPS Inspection logs are misleading

| Property | Value |
|----------|-------|
| Solution ID | sk64166 |
| Date Created | 2011-07-06 |
| Last Modified | 2025-01-16 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- HTTPS Inspection logs show action as "Bypass", but in the HTTPS Inspection rule base the action is "Inspect".

## Cause

HTTPS Inspection rule base execution consists of two steps:

1. Matching the connection against the rule base.
2. Calculating the action to be performed.

Calculation is done according to the matched rule, blades defined on the matched rule and exceptions. So, there can be a scenario, in which the matched rule requires Inspect, but as a result of Step 2, the action is changed to Bypass. In such case, HTTPS Inspection log is sent with data from the matched rule, but the action in the log is BYPASS.

*Example 1:* The rule in the HTTPS Inspection policy defines Action: Inspect and Blade: Threat Emulation. The Threat Emulation blade is not enabled on a specific gateway. On that gateway, the traffic will not be inspected by Threat Emulation, and the log will indicate Action: Bypass.*Example 2* :   
Admin has defined one rule in HTTPS Inspection Policy - "Any Any https Inspect IPS Log" and added 10.1.1.0/24 net to Network Exceptions in IPS blade. User with IP 10.1.1.2 surfs to some HTTPS site.

HTTPS Inspection rule base execution:

1. The connection is matched to the rule with action Inspect.
2. IPS is the only active blade on the matched rule, but the connection is in exception for the IPS blade, therefore the updated action is BYPASS.

*Performed action*: SSL is not terminated, and HTTPS Inspection log sends data from the matched rule, but with action Bypass.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content