topic Re: Log for web proxy traffic with specification of request in Firewall and Security Management

Log for web proxy traffic with specification of request

m1l05 — Wed, 17 Mar 2021 08:51:33 GMT

Hello,

is there any possibility to view the traffic log with specification of requests as they come from clients to explicit web proxy server configured at Checkpoint gateway (R80.30)?

On CP GW: HTTPS Inspection is disabled, X-Forwarded-For is enabled.

Something in style of squid web proxy log, where one can find info about command sent by client, e.g. "CONNECT <dns hostname>:443", "GET http://<dns hostname>/blah.js"

The main aim is to be able to put together client (source) IP address and remote (destination) URL, while the traffic is passing three web proxy servers on its way to destination. Checkpoint explicit web proxy is the first one in the proxy chain, the one contacted by client. There I can see client's source IP address, but destination's IP address is IP address of CP web proxy. The squid web proxy is the second one and there I can find destination URL, but source IP address is IP address of CP web proxy, not the real client's IP adress.

Most of traffic is encrypted, so client's IP address stored in HTTP header X-Forwarded-For is not visible at squid web proxy.

Thank you for any advice or comment

milos

Re: Log for web proxy traffic with specification of request

PhoneBoy — Thu, 18 Mar 2021 02:13:06 GMT

If it is logged it would be done only when detailed/extended logging is done in the relevant rule.
My guess is that it’s not and this would be an RFE.

Re: Log for web proxy traffic with specification of request

m1l05 — Mon, 22 Mar 2021 10:31:07 GMT

Thank you for pointing me to the right direction. I'll check it out.

Re: Log for web proxy traffic with specification of request

FredrikV — Wed, 19 Jan 2022 12:50:51 GMT

Did you do a RFE? If so, what kind of response did you get?

We are in a simular situation, where network traffic from hardened networks are directed to a specific explicit proxy for internet access. However, the log visibility is very poor due to the lack of information regarding destination URL and client source IP address. Now we have to first lookup which proxy node is active, and filter on that as source. It becomes a guessing game.

X-Forwarded-For is enabled and I can see that header in tcpdump, but extended or detailed logging don't seem to get it. Not even when browsing unencrypted HTTP content. I have put togethered a custom log profile containing all kinds of fields that I hoped could help but they'll stay empty in testing.

Thanks.