topic HTTPS Inspection - Limiting Traffic to prevent Remote access protocols in Firewall and Security Management

HTTPS Inspection - Limiting Traffic to prevent Remote access protocols

Martin_Hofbauer — Sun, 27 Nov 2022 15:51:59 GMT

Hi all,

My question is similar to "https://community.checkpoint.com/t5/Security-Gateways/Gateway-as-HTTP-HTTPS-proxy/m-p/159888#M28128"

We want to setup an Internet facing Cluster to replace a non-transparent (HTTP/HTTPS) Proxy . We do NOT want to use the "non-transparent Proxy feature ( for many reasons, also mentioned in the other post) ! Should be a transparent forcing gateway/cluster.

Currently we do not have any possibility for a setup to test this requirement.

One of these rules there at the current proxy is that e.g. MS RDP or Citrix protocol (or another remote access protocol, also SSH) are recognized (if tunneling via HTTPS) and thus these types of connections were rejected.

We want to implement a rulebase to do the same at the CheckPoint R81.10 cluster.

What is required to do this?

It's obvious that HTTPS inspection needs to be turned on.

a) Do we have to enable "protocol signature" for HTTPS and/or HTTP as a prerequisite ?

b) Could one approach be to use applications like "Microsoft Remote Desktop Connection","Citrix" or "SSH" before any other HTTPS/HTTP allow rule to recognize and drop these applications ? Or is another step required: e.g. "drop non-Compliant HTTP" ?

Appreciate any suggestions or ideas!

Thanks
Martin

Re: HTTPS Inspection - Limiting Traffic to prevent Remote access protocols

_Val_ — Mon, 28 Nov 2022 08:15:44 GMT

Why are you posting to the AppSec category? This seems to be HTTPSi question for regular security GWs.

Re: HTTPS Inspection - Limiting Traffic to prevent Remote access protocols

Martin_Hofbauer — Tue, 29 Nov 2022 10:04:08 GMT

Because this is a "Application Security" (...) question ... - as I (unfortunately incorrectly) assumed that this is the category for GW application security
I never worked with "AppSec" - this name is another example of a limited talent of your company choosing meaningfull names for products (look at the history of endless number for names for a VPN client ...)

Thanks for moving to the right category- still waiting for an answer ....

Re: HTTPS Inspection - Limiting Traffic to prevent Remote access protocols

Alex- — Tue, 29 Nov 2022 10:41:29 GMT

Solved: Re: Enable Protocol Signature by default - Check Point CheckMates