topic Re: Cloudguard Appsec Integration with existing nginx reverse proxy in WAF

Cloudguard Appsec Integration with existing nginx reverse proxy

Blason_R — Tue, 27 Jul 2021 03:23:52 GMT

Hi Team,

Does AppSec works with nginx reverse proxy? Lets say I have 5 portals behind nginx reverse proxy as a on-prem server.

Can I -

Deploy on-prem Nginx integration with AppSec
Also we are deciding to move to the cloud wondering then can we move to the cloud?

Re: Cloudguard Appsec Integration with existing nginx reverse proxy

Nir_Shamir — Tue, 27 Jul 2021 08:31:21 GMT

Hi,

You can deploy our Agent on a Linux Server with NGINX deployed on it.

I have done it in a lab environment and it worked with no issues.

When you move to a cloud environment you can just deploy another agent in the new deployment on the server or as a CloudGuard AppSec Gateway to protect it.

Re: Cloudguard Appsec Integration with existing nginx reverse proxy

Blason_R — Tue, 27 Jul 2021 12:51:05 GMT

Hi,

What if I have multiple portals configured in reverse proxy? Can single agent detect those multiple portals? How are the SKUs per portal or per agent.

Re: Cloudguard Appsec Integration with existing nginx reverse proxy

Nir_Shamir — Tue, 27 Jul 2021 13:23:36 GMT

I think the license is per amount of requests or something like that.

anyway you configure on the Agent the IP addresses that it needs to protect so if the requests are going to IP addresses on that server then he will protect all of the portals.

Re: Cloudguard Appsec Integration with existing nginx reverse proxy

Blason_R — Tue, 27 Jul 2021 13:30:24 GMT

Thanks man - the Idea is currently we are using mod_sec and protecting apps like

example.com
test.testing.com
one.notsecurenet.in

etc..

Re: Cloudguard Appsec Integration with existing nginx reverse proxy

Shay_Levin — Wed, 28 Jul 2021 05:48:55 GMT

Hi @Blason_R ,

If you need help with deployment, let me know and i will make sure you will get assistance.

Re: Cloudguard Appsec Integration with existing nginx reverse proxy

Blason_R — Wed, 28 Jul 2021 06:03:13 GMT

Thanks Shay - Since we have done numerous Nginx reverse proxy installations we are pretty confident on it. However I am replicating and testing in my partner portal account and in my test environment. So far is going good and have integrated with nginx.

Once I am confident we then can replicate the same story with our customers as Nginx reverse proxy. However I am confused about commercials and workings.

lets discuss that later for sure - Let me first finish the technical part and if I am stuck will contact you for sure.

TIA

Re: Cloudguard Appsec Integration with existing nginx reverse proxy

Blason_R — Thu, 29 Jul 2021 03:07:50 GMT

Thanks Guys!! It worked perfectly with my test setup and nginx reverse proxy. 😀

Trying few more scenarios with multiple URLs.

Re: Cloudguard Appsec Integration with existing nginx reverse proxy

Blason_R — Thu, 29 Jul 2021 04:33:29 GMT

Hi @Shay_Levin

I am facing this unique issue in further testing. Now my reverse proxy holds two URLs

www.hackme.com

www.box.com

I created two assets for two different websites. However both my websites are getting blocked by Check Point Infinity agent even though I set the profile accordingly. Now for testing purpose I stopped the agent with cpnano -q and both the sites started accessing properly. However when I start the agent it blocks again.

Any reason why?

I restarted the agent but its still blocking the legitimate requests

Re: Cloudguard Appsec Integration with existing nginx reverse proxy

Nir_Shamir — Thu, 29 Jul 2021 11:02:00 GMT

@Blason_R what do you see in the logs ? what is the reason it was blocked ?

could be that the site is vulnerable ?

Re: Cloudguard Appsec Integration with existing nginx reverse proxy

Blason_R — Sat, 31 Jul 2021 02:33:14 GMT

Thanks @Nir_Shamir I had a offline discussion with Shay, Gal and Eyal and found the issue. Well certain features are still in EA and have activated prevent mode directly without learning mode.

Re: Cloudguard Appsec Integration with existing nginx reverse proxy

Blason_R — Mon, 02 Aug 2021 08:25:22 GMT

Thanks a lot @Shay_Levin for helping me out on resolving the issue. It was due to the setting on asset for blocking non-relevant applications and since my web server was listening on other portal request is being blocked by agent.

We added the setting in nginx web server and bypassed that location.

Thanks a lot Team!!