While SSL inspection is vital for detecting threats hidden in encrypted traffic, exceptions must be made for several common scenarions. These could be technical compatibilty issues, Legal and Regulatory Compliance, & Performance and reliability. So this configuration setting similar to a firewall rule, allows to add rules to bypass packets being inspected. The bypass can be performed based on IP, FQDN, Application, & Web Categories.

Additionally any apps defined as SAAS, can be bypassed by the flip of a switch. For example Microsoft strongly recommends bypassing SSL inspection (or SSL Bumping) for Microsoft Teams and other Microsoft 365 services to ensure optimal performance, reliability, and security. This can be done either from the Bypass Rules page or from Firewall->Advanced

Known Limitations:

• DNS Caching and Policy Enforcement Delay
  • Previously resolved IP addresses for a domain or URL may continue to be used until the DNS cache expires or is refreshed.
  • As a result, a domain or URL may remain accessible for a short period after a blocking policy is applied, or may remain blocked after being allowed.
  • The updated policy will take effect only after the relevant cache entries are cleared or expire.