topic Re: Issue with Https inspection in Firewall and Security Management

Issue with Https inspection

Sunil_Sah — Thu, 14 Apr 2022 13:11:19 GMT

We are facing issue with https inspection for all url

and getting below error logs due to this unable to access the urls

Internal system error in HTTPS Inspection due to categorization service timeout

The probe was unable to establish a TCP connection to the destination

Bypassing request as configured in engine settings of HTTPS Inspection

Re: Issue with Https inspection

Chris_Atkinson — Thu, 14 Apr 2022 13:21:44 GMT

Please supply additional information and or contact TAC to investigate further.

At a minimum... when we're trusted CAs last updated and what Gateway version &:JHF?

Re: Issue with Https inspection

the_rock — Thu, 14 Apr 2022 14:15:16 GMT

How is below configured?

Andy

Re: Issue with Https inspection

Kaspars_Zibarts — Thu, 14 Apr 2022 14:27:38 GMT

you might want to check this SK too (HTTPS Inspection log "Internal system error in HTTPS inspection due to categorization service error" in SmartConsole)

sk176925

Re: Issue with Https inspection

the_rock — Thu, 14 Apr 2022 14:30:45 GMT

Good sk, hope that helps.

Re: Issue with Https inspection

AaronCP — Thu, 14 Apr 2022 21:20:07 GMT

Hi @Chris_Atkinson,

Is there any impact of updating the trusted CA list? Does it remove any CA's for any reason? Or simply add new ones?

Our trusted CA list hasn't been updated for a while (at least 2 years) and I'm reluctant to do it without knowing what happens.

Sorry to hijack the thread! Any advice would be much appreciated.

Re: Issue with Https inspection

the_rock — Thu, 14 Apr 2022 21:45:47 GMT

Its 100% safe. I have done it probably more than 100 times and never had a problem.

Andy

Re: Issue with Https inspection

AaronCP — Thu, 14 Apr 2022 22:02:46 GMT

Thanks......again! 🙂

Re: Issue with Https inspection

the_rock — Thu, 14 Apr 2022 22:05:05 GMT

For you, no charge, except iphone charge...thats corny joke of the day ; - )

Re: Issue with Https inspection

Julian_Sanchez — Tue, 14 Jun 2022 15:53:45 GMT

This is the best practices of configurations for R81.10?

Re: Issue with Https inspection

the_rock — Tue, 14 Jun 2022 15:56:32 GMT

I believe so, its by default.

Re: Issue with Https inspection

jkougoulos — Thu, 27 Apr 2023 09:36:50 GMT

we face the same issue in the last days, based on some troubleshooting I did, it looks like the backend of the categorization web site (cws.checkpoint.com) has various issues causing timeouts / 504 errors etc. I mean the sk might help a bit, but it looks like there is a performance issue on the service itself