topic UserCheck page seemingly working randomly in Firewall and Security Management

UserCheck page seemingly working randomly

JPR — Wed, 22 Nov 2023 14:45:17 GMT

Hi all,

I'm blocking Executables among other file types with Content Awareness and configured it to display a blocked UserCheck message when it hits that rule. However, the block message is not working all the time and I can't precisely figure out why.

This is the rule:

And this is logs when it works:

And this is logs when it doesn't work (the rule as such works, however, it doesn't display the block message; it just cancels the download):

So, the apparent difference is that when it doesn't show the UserCheck message, the action is "Redirect" and when it does show it it's "Block". I've found another post discussing this, however, not a solution: https://community.checkpoint.com/t5/Management/Content-Awareness-things-that-do-not-work/m-p/139442#M29486

Is there a reason to this behaviour? And is it fixed in a later version? Running R81.

Thanks!

Best regards

Re: UserCheck page seemingly working randomly

G_W_Albrecht — Wed, 22 Nov 2023 14:54:33 GMT

sk100571: Webpage does not redirect to UserCheck page

Re: UserCheck page seemingly working randomly

the_rock — Wed, 22 Nov 2023 15:22:29 GMT

I had this issue before and below is how I fixed it.

Andy

Re: UserCheck page seemingly working randomly

PhoneBoy — Thu, 23 Nov 2023 14:26:07 GMT

Depending on when in the connection stream we detect an executable is being downloaded, it may not be possible to inject a UserCheck page.
This almost certainly will require HTTPS Inspection to be enabled as well.

Re: UserCheck page seemingly working randomly

JPR — Mon, 27 Nov 2023 14:35:58 GMT

Hi Andy,

Thanks for your reply. Unfortunately it didn't resolve the issue.

I suspect it has something to do with what PhoneBoy mentions in his comment, because it seems only to malfunction when the download link redirects the download to somewhere else which also would explain the "Redirect" log.

Re: UserCheck page seemingly working randomly

JPR — Mon, 27 Nov 2023 14:38:24 GMT

Hi,

Thanks for your reply, however, I don't think it addresses my issue. It seems like it only fails to display the UserCheck message when the download link redirects the actual download somewhere else and it might be something to do what PhoneBoy mentions that it's simply not possible to inject the UserCheck page in the connection stream.

Re: UserCheck page seemingly working randomly

the_rock — Mon, 27 Nov 2023 14:39:46 GMT

You need https inspection 100%. Without it, even for URLF blade, it will just show you goofy page that its reset or something like that, so to a regular user, they will be calling your help desk all day long : - )

Andy

Re: UserCheck page seemingly working randomly

Timothy_Hall — Mon, 27 Nov 2023 20:27:11 GMT

I've seen this before, if a detection was made in an HTTP download stream a UserCheck cannot be displayed since the browser is just expecting a stream of downloaded bytes that it is directing into a file, it is not parsing the downloaded contents for HTML code that could display a UserCheck to the user. A TCP RST and failed download is the only way out here. The "Redirect" action you saw means that a UserCheck was configured to be sent, but could not be for technical reasons, and the user never saw it.