topic Re: Gateway as HTTP/HTTPS Proxy in Firewall and Security Management

Gateway as HTTP/HTTPS Proxy

Wolfgang — Fri, 10 Feb 2023 08:36:23 GMT

We have a requirement to use a gateway as HTTP / HTTPS proxy for around 25.000 clients. I'm not really happy in the past with the proxy feature on Check Point appliances and I know the limitation. We are in discussion with the local SEs but I want to ask here and maybe someone has experience wiht the newer releases and the proxy feature.

The gateway should be the proxy for the clients and forward the traffic to internet or another proxy and we want to do some URL-filtering on this traffic.

Any suggestion are welcome.

Re: Gateway as HTTP/HTTPS Proxy

Chris_Atkinson — Fri, 10 Feb 2023 09:15:53 GMT

Sizing is the primary concern since all traffic will be F2F, refer:

sk92482 - Performance impact from enabling HTTP/HTTPS Proxy functionality

Re: Gateway as HTTP/HTTPS Proxy

Wolfgang — Fri, 10 Feb 2023 09:26:04 GMT

@Chris_Atkinson Yes I know. We are running an Maestro environment and it's no problem to add more appliances. This is the real benefit of Maestro. Does Check Point knows such a solution with proxy feature enbled ?

Re: Gateway as HTTP/HTTPS Proxy

Chris_Atkinson — Fri, 10 Feb 2023 23:17:04 GMT

In practice I've personally only seen this done across multiple discrete gateways / clusters using WPAD/PAC or DNS-RR to load-balance.

Possibly something you could replicate with multiple SGs.

Would recommend having your SE engage with Solution Center to arrive at the correct approach.

Re: Gateway as HTTP/HTTPS Proxy

Machine_Head — Fri, 10 Feb 2023 09:50:30 GMT

It being maestro i would also do an estimation of connection numbers.

As the connection number limit in Maestro i much lower than on the regular gateway.

Re: Gateway as HTTP/HTTPS Proxy

Chris_Atkinson — Fri, 10 Feb 2023 23:18:27 GMT

Whilst true to extent it depends on the exact number & model of gateways (and their memory population) used as to exactly how relevant that is to a given deployment.