topic Re: HTTPS inspection not working correctly in Firewall and Security Management

HTTPS inspection not working correctly

VadimVyatkin — Wed, 16 Jun 2021 12:19:57 GMT

Colleagues, good afternoon. When testing the equipment, we faced the following problem. When HTTPS inspection is enabled, web pages on client machines do not open correctly. Those. may not open completely, or remain empty. Some links don't open at all.
Our equipment: model 6200 / Cluster HA / R 80.40 / Take118 / dedicated management server. We use a self-signed certificate issued by our CA. The number of users at the moment is about 300. However, the same symptoms were observed with a few users.

I would be very grateful for help in finding the reason.

Re: HTTPS inspection not working correctly

Alex- — Wed, 16 Jun 2021 13:23:13 GMT

There's a bunch to go through to properly create an HTTPS Inspection setup.

The following TechTalk is very interesting to ensure you have a good baseline policy, especially if you're evaluating the solution.

https://community.checkpoint.com/t5/Security-Gateways/HTTPS-Inspection-Best-Practices-TechTalk-Video-Slides-and-Q-amp/m-p/70842

Re: HTTPS inspection not working correctly

Jan_Kleinhans — Thu, 17 Jun 2021 06:54:41 GMT

Hello, this could be an issue with take 118. We (and also 5 other Checkpoint customers) have also problems since take 118 that SSL Inspection is very slow.

Regards,

Jan

Re: HTTPS inspection not working correctly

VadimVyatkin — Thu, 17 Jun 2021 09:03:13 GMT

Thank you very much for your reply. The video is very informative. So does the rest of the information.

Unfortunately no solution to our problem has been found yet

Re: HTTPS inspection not working correctly

VadimVyatkin — Thu, 17 Jun 2021 09:05:57 GMT

Hello, the previous Take showed the same picture.

Re: HTTPS inspection not working correctly

Vladimir — Thu, 17 Jun 2021 10:54:46 GMT

Just to cover the fundamentals, do you have this self-signed cert issued by you CA installed on your clients' machines as a trusted root CA?

Are those Macs or PCs?

What kind of browsers are you using? Some rely on their own certificate repository, instead of Windows.

Re: HTTPS inspection not working correctly

VadimVyatkin — Thu, 17 Jun 2021 12:54:15 GMT

All inspection settings were made according to the guidelines and best practices. Initially, we used a certificate issued by our CA for Check Point, namely a certificate for a subordinate CA. Accordingly, client machines in the domain trusted him. Clients use Windows OS. The preferred browser is Chrome, but some also use FireFox, which needs to be additionally configured so that it accesses the system certificate store. As a result, the certificates are where they should be, clients trust them. We turn on the inspection and observe strange behavior when opening web pages. Something is opend, something is not, something is partial. In search of reasons, we changed the certificate to a self-signed CheskPoint, extended it to clients, but unfortunately, the picture remained the same.

One could say that the load for the 6200 is too heavy. 300 users. But according to CPView, the load on the cores is 35 percent on average, there is enough memory.

Re: HTTPS inspection not working correctly

Vladimir — Thu, 17 Jun 2021 13:05:10 GMT

Is it safe to presume that you have updated the trusted root CA store on Check Point (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk64521 )?

If it is done, can you post the sanitized HTTPS inspection policy for us to take a look at?

Do you, perchance, block QUIC/HTTP3 (UDP on port 443)?

Also, it'll be helpful if you can provide a few sites that you are experiencing issues with.

Re: HTTPS inspection not working correctly

Vladimir — Thu, 17 Jun 2021 13:20:53 GMT

P.S. Just in case, can you confirm that there is no EDR or AV on the clients that is also performing HTTPS inspection?

Can you check this in the sites that are successfully loading and those that are not and report your findings?

Re: HTTPS inspection not working correctly

VadimVyatkin — Fri, 18 Jun 2021 06:51:29 GMT

Yes, CA list is up to date

QUIC is blocked by cleanup rule of firewall

AV does not perform HTTPS inspection

If the site does not load correctly, everything is fine on the security tab.

Re: HTTPS inspection not working correctly

VadimVyatkin — Fri, 18 Jun 2021 06:57:30 GMT

(view in My Videos)

Problems mainly with search engines, large aggregators ...

Re: HTTPS inspection not working correctly

vNenad — Wed, 14 Jul 2021 14:29:07 GMT

I can confirm that we have the same issue with two of our customers after upgrade to Take 118. Did you open a TAC ticket?

Re: HTTPS inspection not working correctly

VadimVyatkin — Fri, 16 Jul 2021 05:59:35 GMT

With the previous patch, the situation was the same. The transition to 118 did not change anything. We turned to TAC. We are waiting for a decision.

Re: HTTPS inspection not working correctly

Durin — Mon, 08 Nov 2021 15:54:45 GMT

Hi there, experiencing same issues.

Did you come across any solution for this issue?

Re: HTTPS inspection not working correctly

Jan_Kleinhans — Tue, 09 Nov 2021 15:18:32 GMT

Hello,

we have a Hotfix running on Take 125. Our SR was SR#6-0003021978.

Regards,

Jan

Re: HTTPS inspection not working correctly

Ed_Eades — Mon, 24 Jan 2022 15:26:11 GMT

We recently turned on HTTPS Inspection and used Best Practice setup. We are using a Gateway self-signed cert and have pushed it out to clients. Our HTTPS Inspection policy is applied on a very small sub set of devices and networks for testing purposes before applying it to more enterprise wide. We have also noticed some strange behavior when opening web pages. Some pages may load as expected, some pages do not load, and some pages may only load partially. The partially loading seems to be the most common but all of it is somewhat random in nature and not related to specific sites. When either a page doesn't load or somewhat loads a simple refresh will make the page load. The partial loading does seem to be most present on sites that may have more content delivery images and links present. That is where you may see partial images load. This behavior can be noticed across all web browsers. We are hesitant to push this out to more networks until finding a resolution.

I just came across this article in my research and see some similarities to our setup and experience. We have engaged TAC. In the meantime hoping to see if anyone has additional feedback or possible resolution in their scenario.

Many Thanks.

Re: HTTPS inspection not working correctly

_Val_ — Mon, 24 Jan 2022 17:53:52 GMT

I suggest you ask in a separate post and ask for guidance. There is no need to highjack a someone else's thread.

Re: HTTPS inspection not working correctly

maad-pul — Tue, 15 Mar 2022 21:00:44 GMT

Did you get any PMTR number for this issue?

Re: HTTPS inspection not working correctly

SSlater — Wed, 16 Mar 2022 05:59:48 GMT

Any Drops, or HTTPS Inspection Logs associated with the traffic that might indicate an error/failure/drop?

Some Examples:

Internal system error in HTTPS Inspection (Error Code: 1)
Internal system error in HTTPS Inspection (Error Code: 3)
Internal system error in HTTPS Inspection due to categorization service timeout
Internal system error in HTTPS Inspection process during SSL negotiation

If there's nothing clearly seen here... It may be worth taking a packet capture from the Client PC/Firewall to see how the TCP Handshake is going, How the Server/Client Hellos are working, TLS, etc..

You can compare this to a packet capture of the same site without HTTPS inspection enabled, compare/contrast for better understanding of "where" it is breaking.

Also a side-note that might not apply: Sometimes we can see RAD (Resource Advisor) Timeout/Error for Application Control/URL Filtering causing holdups while the HTTPS inspection is working fine.

Re: HTTPS inspection not working correctly

pfinksai — Fri, 18 Mar 2022 13:51:12 GMT

Import internal CA to client