topic Re: Inbound HTTPS inspection with Site Category in Firewall and Security Management

Inbound HTTPS inspection with Site Category

Alejandro_Ferna — Wed, 13 May 2020 10:33:18 GMT

Hi, I'm trying to use inbound https inspection with site category but I'm getting this error:

Internal system error in HTTPS Inspection (Error Code: 2)

If I remove the site category the inspection works fine, but this is not an option for me since all of my domains points to the same webserver.

My goal is to create a custom site+rule with the corresponding certificate for every domain.

This is the rule:

I'm using a non-standard port since the gateway is in AWS and the traffic is received from a load balancer. I have added the port in the Application Control & URL filtering Advanced Settings but the error persist.

It's necessary to enable the Application Control and/or URL filtering blades on the gateway for this to work? When I have tryed it I get the error "URL filtering blade is not responding" and I can not install policy.

Any hint will be apprecieted, thank you

Regards

Alex

Re: Inbound HTTPS inspection with Site Category

PhoneBoy — Thu, 14 May 2020 17:49:15 GMT

Custom Applications/Sites require either App Control OR URL Filtering blade to be active.
For this specific use case, App Control is better.

Re: Inbound HTTPS inspection with Site Category

Alejandro_Ferna — Fri, 15 May 2020 08:00:48 GMT

OK, now I have to find the reason why I can not activate the blade...

Thank you!

EDIT: I dont know why but at second attempt I have been able to install policy and the error is gone. Now I have the Application control blade enabled but I'm still getting the "Internal system error in HTTPS Inspection (Error Code: 2)" message.

I keep investigating.

Re: Inbound HTTPS inspection with Site Category

Alejandro_Ferna — Fri, 15 May 2020 11:41:05 GMT

It's working.

I leave here my experience in case it is helpful to someone else:

I'm not sure if the fact that our web server works with SNI / virtualhost affects inspection in some way but, in my case, the inspection only works with Application Control and URL Filtering blades both enabled.

Only with AC I get Internal system error in HTTPS Inspection (Error Code: 2)

Trying to only enable URL Filtering the policy installation fails with "Policy installation failed on gateway. If the problem persists contact Check Point support (Error code: 0-2000112)."

With both enabled, the inspection is working and the IPS is blocking correctly the HTTPS urls that match the IPS protections.

Now I'm stepping forward testing with two domains/rules:

When I test the first domain, the first rule matches the traffic and does the inspection.
When I test the second domain, the second rule does not match the traffic.

I'll keep updating.

Re: Inbound HTTPS inspection with Site Category

Timothy_Hall — Fri, 15 May 2020 12:50:43 GMT

Not surprised, the APCL and URLF blades while separate, are heavily intertwined in both policy configuration and implementation since R75.40. I've seen some odd behavior in my training lab when trying to enable only one of them.

Re: Inbound HTTPS inspection with Site Category

PhoneBoy — Fri, 15 May 2020 19:42:44 GMT

That sounds like a bug and is probably worth a TAC case (only having APCL and not URLF enabled results in error).