topic Re: Check Point URLF for inbound traffic in Firewall and Security Management

Check Point URLF for inbound traffic

Arun_Malipatil1 — Tue, 21 Jan 2020 11:31:21 GMT

We use Check Point URL filtering for controlling the access to websites hosted outside the organization and we follow blacklisting mechanism to block access to a particular website. Now, in my scenario, I have a web server(behind the CHKP FW) hosting multiple websites using the same IP(10.10.10.100--NATed-to-a-public-IP-on CHKP) and port 80 for all the websites. The differentiation of each site can be done using the HTTP unique attribute called Host Header.

My Questions:

1. Is there a way we can use URL filtering to block access to a few of my webserver from the Internet?

2. If not, do we have any other way?

Note: As both IP addresses and Port numbers are same for all the internal web servers I cannot use NAT and FW rule base to block certain sites.

Re: Check Point URLF for inbound traffic

G_W_Albrecht — Tue, 21 Jan 2020 14:15:02 GMT

My first question is : what do you want to achieve with this setting ? You do have several virtual servers hosting websites on one server with identical IP and port, so if you do not want anyone from internet connect to some websites, just unpublish them. For having internal (blocked from internet access) and public servers i would just use a different configuration...

Re: Check Point URLF for inbound traffic

PhoneBoy — Tue, 21 Jan 2020 16:20:23 GMT

You should be able to achieve this with Application Control, possibly using custom signatures generated with the Application Control Signature Tool.

Re: Check Point URLF for inbound traffic

Arun_Malipatil1 — Thu, 23 Jan 2020 13:23:32 GMT

As customer was performing internal audit which led us to such requirement and without making any changes on servers.

Re: Check Point URLF for inbound traffic

Arun_Malipatil1 — Thu, 23 Jan 2020 13:26:47 GMT

Thank you PhoneBoy! Where I can find the AppCtrl signature tool? Do we need to contact support team?

Re: Check Point URLF for inbound traffic

Wolfgang — Thu, 23 Jan 2020 14:29:20 GMT

Inbound URL-Filter works like outbound URL-filter. The same way you can block from your internal clients access to www.my-webserver.com you can do from external. Define your webserver as website in the URL-Filter-blade and configure a block rule with these website. You have to enable URLF-blade for this.

You don't need the AppCtrl signature tool, it's all based on the URLs.

Wolfgang

Re: Check Point URLF for inbound traffic

PhoneBoy — Thu, 23 Jan 2020 19:43:41 GMT

The only reason I suggested the ACST was because, depending on the requirements, it may not be sufficient.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103051