Integration with the TCP/IP stack – operation and diagnostics

1. What is integration with the TCP/IP stack?

Integration with the TCP/IP stack is responsible for filtering network traffic generated by users. This feature is used by nVision to:

• block websites,
• block downloads of files with specific extensions.

Back to top

2. Why can integration cause issues?

To analyze encrypted HTTPS traffic, nVision uses its own certificate.

Technically, this mechanism intercepts the HTTPS connection initiated by the application, decrypts it for analysis, and then re-establishes the connection using the nVision certificate.

From the application's point of view, this behavior corresponds to a Man-in-the-Middle (MITM) mechanism. This is expected and intended behavior used by solutions that filter HTTPS traffic.

However, some applications have additional security mechanisms, such as certificate pinning or their own certificate validation. In such cases, they may not accept the substituted certificate and may terminate the connection or completely refuse communication.

Back to top

3. When is it recommended to disable integration?

If there is a conflict with an application or website, it is recommended to first add exceptions for the specified addresses, domains, or applications.

Most often, this applies to:

• applications using a qualified electronic signature,
• banking applications,
• applications using their own certificate validation,
• software using certificate pinning mechanisms,
• environments where another solution performing SSL/TLS inspection is running at the same time.

If the issue is resolved after adding an exception or disabling integration, this means that the cause is the way the given application handles encrypted HTTPS traffic.

Back to top

4. Recommended procedure – banking website example

First, it is recommended to add exceptions for the specified applications or URLs so that they are not analyzed by the TCP/IP stack integration.

For this example, we will use the website https://sprawozdawczosc.nbp.pl/, which requires certificate-based login.

1. After opening the NBP website, you can see that the Axence certificate has been substituted on the website.
   
    
2. As a result, a login issue may occur when logging in to sprawozdawczosc.nbp.pl.
   
    
3. In this case, add an exception for the website by clicking Manage policies:
   
    
4. Then, in the nVision Agent compatibility section, select the policy that is applied to the devices:
   
    

5. In the policy configuration, in the TCP/IP stack integration section, select Excluded addresses and domains, and then enter, for example:

   *.nbp.pl*

   
    

6. After completing the steps above, the NBP website will no longer be filtered, and the certificate will no longer be substituted.

Back to top

5. Recommended procedure – FileZilla / WinSCP

The issue may also affect applications that use encrypted connections, such as FileZilla or WinSCP. For FTP over TLS/SSL or SFTP connections, the application may additionally verify the server certificate or host key.

If the TCP/IP stack integration intercepts and analyzes such traffic, the application may detect a change in the way the connection is established and terminate the communication. This may result in a certificate error, TLS/SSL connection error, rejected connection, or inability to log in to the server.

In this case, it is recommended to add an exception for the server address, domain, or application affected by the issue.

1. Add an exception for the application process, for example:

   filezilla.exe
   winscp.exe

   
    

2. After saving the changes, wait until the policy is applied on the device or restart the Agent / computer if required.
3. Check the connection in the application again.

Back to top

6. Effects of disabling integration

After disabling integration with the TCP/IP stack, nVision:

• does not filter downloaded files,
• does not filter websites based on configured rules.

Back to top