topic Re: Gateway as HTTP/HTTPS proxy in Firewall and Security Management

Gateway as HTTP/HTTPS proxy

dianammar — Tue, 18 Oct 2022 20:03:07 GMT

If the firewall is configured as HTTP/HTTPS proxy, and user is using for example SSH over HTTP, does the firewall proxy this traffic?

Re: Gateway as HTTP/HTTPS proxy

PhoneBoy — Tue, 18 Oct 2022 20:14:38 GMT

While we support being configured as an (explicit) HTTP/HTTPS proxy, it's not a configuration we generally recommend.
Performance characteristics of proxy mode are substantially different and recommend you work with your Check Point SE to ensure your gateways are appropriately sized for such a configuration.

To answer your specific question, it entirely depends on how the SSH traffic is being tunneled as to whether it will be detected or not.
It also depends on whether you've enabled IPS and have the SSH over Non-Standard Port signature enabled (how such behavior is typically detected).

Re: Gateway as HTTP/HTTPS proxy

dianammar — Tue, 18 Oct 2022 20:25:04 GMT

So in general, can we limit any other protocols so they don't be passed by the proxy if they run over HTTP or HTTPS?

Re: Gateway as HTTP/HTTPS proxy

PhoneBoy — Tue, 18 Oct 2022 22:29:05 GMT

First of all, an HTTP proxy won't work if the HTTP that comes across it is not well formed.
Beyond that, yes, you can do further limiting with App Control and/or IPS.
You will probably also need HTTPS Inspection enabled as well.

Re: Gateway as HTTP/HTTPS proxy

Chris_Atkinson — Wed, 19 Oct 2022 01:08:16 GMT

Yes, note protocol signatures may also be something to explore here e.g.

Re: Gateway as HTTP/HTTPS proxy

rrbranco — Thu, 20 Oct 2022 16:22:55 GMT

On your case, would it be possible to consider using SSH DPI ?

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/Topics-TPG/Using-SSH-Inspection.htm?Highlight=ssh%20inspection%20

Re: Gateway as HTTP/HTTPS proxy

dianammar — Mon, 24 Oct 2022 15:34:55 GMT

Thanks everyone. We might consider SSH DPI for SSH traffic as well as inforcing policies with App control