topic Re: Issue on matching rules after upgrading to 81.10 in Firewall and Security Management

Issue on matching rules after upgrading to 81.10

Netadmin2020 — Fri, 25 Mar 2022 05:09:44 GMT

Hello guys,

after upgrading our gateways and secure management server to 81.10, there is suddenly a matching issue. I am attaching images.

Rules we working appropriate before the update. What are you proposing in this case? (images attached)

and in some cases I am seeing these:

Re: Error on updating - Internal error in a hook script: bin/hook_cvpn_HOTFIX_R80_40_JUMBO_

Netadmin2020 — Thu, 24 Mar 2022 22:21:56 GMT

after going to 81.10, I am experiencing a new issue. Suddenly the is a matching issue on many destinations.Images attached.

Rules were working appropriate on 80.40...

Re: Issue on matching rules after upgrading to 81.10

G_W_Albrecht — Fri, 25 Mar 2022 08:15:56 GMT

I would suggest to contact TAC !

Re: Issue on matching rules after upgrading to 81.10

PhoneBoy — Fri, 25 Mar 2022 13:03:57 GMT

Those drops are probably: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111643&partition=Advanced&product=Quantum
The ones with HTTPS Inspection are probably related to the SNI probing we do to validate SNI (which can be spoofed).

Re: Issue on matching rules after upgrading to 81.10

Naama_Specktor — Sun, 27 Mar 2022 07:24:48 GMT

Hi @Netadmin2020

M name is Naama Specktor and I am checkpoint employee ,

If you opened a TAC SR , I will appreciate it if you will share the number .

thanks,

Naama

Re: Issue on matching rules after upgrading to 81.10

Netadmin2020 — Sun, 27 Mar 2022 07:53:13 GMT

I have already inform our partner for the current issue. I am little bit confused about https inspection and sni.Which is the best practice?

I am on 81.10, your proposal is to apply https bypass to everything and leave the sni to do the job?

Re: Issue on matching rules after upgrading to 81.10

PhoneBoy — Mon, 28 Mar 2022 23:51:32 GMT

HTTPS Inspection is needed to do full threat prevention and content inspection on encrypted traffic.

SNI is used to identify domains you are accessing without decrypting the connection.
It can also be used to determine whether or not a connection requires full HTTPS Inspection (i.e. as part of a bypass rule).