topic Re: Has anyone tried adding MAB portal behind WAF or reverse Proxy? in Firewall and Security Management

Has anyone tried adding MAB portal behind WAF or reverse Proxy?

Blason_R — Tue, 07 Sep 2021 03:32:37 GMT

Hi Team,

I am trying to figure out if Check Point SSL VPN/MAB portal can be routed through WAF or reverse proxy? I tried with nginx however I am able to login but it fails at the SNX.

Has anyone tried this before? Is it really needed to put the MAB portal behind WAF? Are we gonna get any benefit out of it?

TIA

Blason R

Re: Has anyone tried adding MAB portal behind WAF or reverse Proxy?

PhoneBoy — Tue, 07 Sep 2021 08:07:03 GMT

MAB is effectively a reverse proxy and it's designed with security in mind.
Not sure that you will see much security benefit from putting MAB behind a WAF.
In any case, the WAF will most likely require some level of tuning in order to permit the necessary traffic for SNX.

Re: Has anyone tried adding MAB portal behind WAF or reverse Proxy?

Blason_R — Sun, 19 Sep 2021 05:13:54 GMT

Well - I decided to debug and as I said I can loing successfully but when snx pops up it does not go after that. Can someone help me here.

Here is the logs it does not go after and I receive error at SNX popup

45.112.144.190 - - [19/Sep/2021:10:41:10 +0530] "GET /Login/ComponentFrame?nPageMode=2&snxVersion=80,0,0064,18 HTTP/1.1" 200 1150 "https://xx.xx.xx.xx/SNX/extender" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"

Re: Has anyone tried adding MAB portal behind WAF or reverse Proxy?

PhoneBoy — Mon, 20 Sep 2021 02:07:35 GMT

What precisely is this a log from?

Re: Has anyone tried adding MAB portal behind WAF or reverse Proxy?

Blason_R — Mon, 20 Sep 2021 02:37:41 GMT

Are you referring to those logs? Those are nginx reverse proxy logs and when I debug further I observed that Mobile Access Portal is sending or hopping to Websocket once the connection is established which is sending a Header to Upgrade.

I am not sure whether that would help?

I guess little more persistence from me and assistance from you guys would definitely help me to achieve the solution.

Re: Has anyone tried adding MAB portal behind WAF or reverse Proxy?

PhoneBoy — Mon, 20 Sep 2021 02:53:51 GMT

Certainly the more information you can provide the better.
That said, SNX surely expects to talk to the MAB gateway directly and isn't meant to be proxied through something else.