topic Re: FW rules base on HTTP/HTTPS application without application control license in Firewall and Security Management

FW rules base on HTTP/HTTPS application without application control license

elbrabra_94 — Tue, 12 Nov 2019 17:14:24 GMT

Hello,

We would like to create FW rules to only authorize HTTP and HTTPS traffic (without decrypt HTTPS traffic) regardless of the port used (standard or not). Is-it something feasible without Application control license?

Thank you very much for your feedback,

Regards

Re: FW rules base on HTTP/HTTPS application without application control license

PhoneBoy — Tue, 12 Nov 2019 18:56:16 GMT

To determine whether traffic is "Web Browsing" or not requires Application Control.
With current licensing, this means at least an NGFW subscription.

Re: FW rules base on HTTP/HTTPS application without application control license

elbrabra_94 — Wed, 27 Nov 2019 15:40:28 GMT

Thank you for your help, I get from Checkpoint a trial license for testing purposes.

But after that I had an issue. I activated application control & url filtering blade and create a rule to match web browsing traffic (With Any as services). The rule is not matched except if I remove Web browsing application and use instead Any.

Do you how can I troubleshoot this? I didn't find any documentation about application control troubleshooting part.

Re: FW rules base on HTTP/HTTPS application without application control license

mdjmcnally — Wed, 27 Nov 2019 18:28:17 GMT

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk73220&partition=Advanced&product=Application

ATRG for Application Control

Re: FW rules base on HTTP/HTTPS application without application control license

elbrabra_94 — Thu, 28 Nov 2019 14:58:39 GMT

Thank you very much,

Thanks to your sk links I think I found the issue explanation. Appi_status.C file show an empty value on variable

app_db_version () and I have this app_update_description :

"Update failed. Gateway can not access internet ('https://secureupdates.checkpoint.com/appi/v4_0_1/gw/Version'). Check connectivity and proxy settings

I didn't understand internet access was also needed on Security Gateway, A proxy was only configured on the management server.

Is there any other way to get application dabatase update without configuring internet access on the gateway ? For example retrieving update from management instead ?

Re: FW rules base on HTTP/HTTPS application without application control license

mdjmcnally — Thu, 28 Nov 2019 15:07:22 GMT

Unlike traditional solutions then Check Point Application Control/URL Filtering do not rely on having the database locally.

They instead have very limited cache at the Appliance level but then rely on connecting from the Gateway to the Cloud to do the categorization.

So in order for AppCtrl/URL to work then it needs to be able to connect to the Check Point Cloud to do the categorization.

IPS can have an offfline update but not the AppCtrl/URL

Re: FW rules base on HTTP/HTTPS application without application control license

PhoneBoy — Thu, 28 Nov 2019 21:17:56 GMT

App Control does have some local signatures.
However, the gateway must have Internet access to periodically update them.
This is per: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk73220

URL Filtering definitely requires Internet access...or a Private ThreatCloud appliance.
I believe App Control signatures can also be retrieved from a PTC appliance as well.

Re: FW rules base on HTTP/HTTPS application without application control license

elbrabra_94 — Mon, 02 Dec 2019 10:33:31 GMT

Ok it's clear, thank you for your help