<p>I have 2 AKS clusters, Cluster 1 and Cluster 2 both running Istio 1.14 minimal out-of-the-box (default configs).</p>
<p>Everything on Cluster 1 works as expected (after deploying Istio).</p>
<p>On Cluster 2, all HTTPS outbound connections initiated from my services (injected with istio-proxy) fail.</p>
<pre><code>curl http://www.google.com  #works
curl https://www.google.com #fails
</code></pre>
<p>If I create a service entry for google, then the https curl works:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: google
spec:
  hosts:
  - www.google.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL
</code></pre>
<p>Both Istio installations are out-of-the-box so <code>meshConfig.outboundTrafficPolicy.mode</code> is set to <code>ALLOW_ANY</code> (double-checked).</p>
<p>I read online that there were some Istio bugs that would cause this behavior, but I don't think it's the case here. I also compared the Istio configs between the 2 clusters and they really seem to be the same.</p>
<p>I'm starting to think the problem may lie in some cluster configs because I know there are some differences between the 2 clusters here.</p>
<p>How would you go about troubleshooting this? Do you think the issue is related to Istio or Cluster services/configs? What should I look into first?</p>

Bogdan993
<p>You are correct.  By default ALLOW_ANY is value set for meshConfig.outboundTrafficPolicy.mode. This can be verified in the cluster by running below command.</p>
<pre><code>kubectl get configmap istio -n istio-system -o yaml | grep -o &quot;mode: ALLOW_ANY&quot;
</code></pre>
<p>Please also refer the <a href="https://istio.io/latest/docs/tasks/traffic-management/egress/egress-control/" rel="nofollow noreferrer">istio documentation</a> for the options available in accessing external services</p>
