topic Re: Blueprint design for inbound webtraffic in onpremise datacenter in WAF

Blueprint design for inbound webtraffic in onpremise datacenter

Mischa_Meekes — Fri, 01 Oct 2021 12:23:18 GMT

We are looking for a design concept or best practice setups for onpremise datacenter environment where 90% of traffic is inbound https.

We are already using R80.40 clusters and Citrix netscalers (for loadbalancing and ssl offloading) but we also want to use the Appsec.

Upgrade to R81 is planned.

Does Checkpoint has some kind of document or blueprint in order to create the best setup for doing security on this incoming https traffic.

One question for example is which component can or should do IPS. The gateway or the appsec.. or both ?

Please let me know which thoughts about those kind of setups are the in community

Re: Blueprint design for inbound webtraffic in onpremise datacenter

PhoneBoy — Fri, 01 Oct 2021 18:23:50 GMT

My guess is that it would probably be similar to that in public cloud except you're using on-prem load balancers.
AppSec can also do IPS:

Re: Blueprint design for inbound webtraffic in onpremise datacenter

Nir_Shamir — Sun, 03 Oct 2021 08:04:53 GMT

Hi,

if you want to use AppSec then it also has IPS capabilities specifically for WEB traffic. So it you activate it on AppSec you don't need to do double inspection and activate it on the Gateways also.

you might just activate it for other protocols passing through your Gateways using the Threat Prevention policy.