topic Re: HTTPS inspection causing timeout in Firewall and Security Management

HTTPS inspection causing timeout

flachance — Mon, 05 Feb 2024 15:24:03 GMT

Hi,

Firewall is running R80.20.

We have a web server used for clients to upload files.

Https inspection is enabled and setup for incoming connections to this server.

When they try to upload large files around 350MB it times out.

If I disable https inspection it works. Is there any limitations for HTTPS inspection and large file?

Thanks

Francis

Re: HTTPS inspection causing timeout

Lesley — Mon, 05 Feb 2024 18:00:01 GMT

Version is to old to give any good advice.

Maybe start with upgrade if not possible you can check: https://support.checkpoint.com/results/sk/sk150933

Re: HTTPS inspection causing timeout

flachance — Mon, 05 Feb 2024 18:01:40 GMT

Oups I did it again. It's a typo. We're at R81.20

Re: HTTPS inspection causing timeout

the_rock — Mon, 05 Feb 2024 18:24:33 GMT

Yea, thats a tricky problem, specially if its inbound https inspection. I would personally open TAC case, but they will probabl;y ask you to debug wstlsd process.

Andy

https://support.checkpoint.com/results/sk/sk112066

Re: HTTPS inspection causing timeout

PhoneBoy — Mon, 05 Feb 2024 21:38:03 GMT

It may not be HTTPS Inspection, but one of the other Software Blades.
What is enabled here?

Re: HTTPS inspection causing timeout

flachance — Tue, 06 Feb 2024 13:52:05 GMT

IPSec VPN, Mobile Access, Application Control, URL filtering, Identity Awareness, Cluster XL, Monitoring, IPS, Anti-Bot, Anti-Virus.

As I get more detail about this, It's not just for very large file upload. It's for any file upload but it's intermittent, sometime it works sometime it doesn't. Though the larger the file, the more it seems to fail.

But if I disable HTTPS inspection for incoming connections to that web server, it works every time.

Re: HTTPS inspection causing timeout

the_rock — Tue, 06 Feb 2024 13:55:28 GMT

I would still follow the sk I gave you, because it may help you lots before opening TAC case, as Im fairly sure they would ask you to run that debug.

Andy

Re: HTTPS inspection causing timeout

flachance — Tue, 06 Feb 2024 13:57:03 GMT

Yes, I did that and opened a ticket. We'll see what they say.

Re: HTTPS inspection causing timeout

the_rock — Tue, 06 Feb 2024 13:58:10 GMT

To help you out further, if you are allowed to, I am happy to check the debug myself, as long as you are allowed to send it.

Best,

Andy

Re: HTTPS inspection causing timeout

flachance — Tue, 06 Feb 2024 14:35:06 GMT

Thanks Andy, I appreciate the offer. I don't think I'm allowed so I'll wait for TAC's answer. I'll post updates when they get back to me.

Re: HTTPS inspection causing timeout

the_rock — Tue, 06 Feb 2024 14:37:36 GMT

Totally fair, I dont want you to be in trouble because of that. Let us know what TAC says. Hope there is quick solution.

I am running really good https inspection lab on R81.20, so will log in later and see if there are some settings in legacy dashboard that could cause this. Will take some screenshots and send it over, just working on some Azure stuff now, so may be in couple hours or so.

Best,

Andy

Re: HTTPS inspection causing timeout

the_rock — Tue, 06 Feb 2024 15:15:50 GMT

K, just taking a break from Azure stuff, man, its like a mammoth of things lol

Anywho, I attached what I was referring to. Would you mind please let us know how you have those configured?

Best,

Andy

Re: HTTPS inspection causing timeout

flachance — Tue, 06 Feb 2024 18:57:46 GMT

Re: HTTPS inspection causing timeout

the_rock — Tue, 06 Feb 2024 19:22:00 GMT

Looks right to me...anyway, lets wait see what TAC says. Im super curious how this gets solved.

Andy

Re: HTTPS inspection causing timeout

PhoneBoy — Tue, 06 Feb 2024 19:45:53 GMT

What Threat Prevention profile applies to this connection?
Is it a custom profile or one of the standard ones (e.g. "Optimized")?
Or are you using Autonomous Threat Prevention?

Re: HTTPS inspection causing timeout

flachance — Tue, 06 Feb 2024 19:50:27 GMT

custom.

Re: HTTPS inspection causing timeout

the_rock — Tue, 06 Feb 2024 20:03:31 GMT

That has to work 100%. I have client that implemented inbound https inspection on R81.10 and there were no issues. I would expect it to be better in R81.20

Andy

Re: HTTPS inspection causing timeout

Alex- — Tue, 06 Feb 2024 20:09:38 GMT

I would change Low Confidence from Detect to Inactive.

Re: HTTPS inspection causing timeout

flachance — Tue, 06 Feb 2024 20:15:42 GMT

You know, that's not a bad idea at all. I don't recall ever having any use for Low Confidence detection.

Re: HTTPS inspection causing timeout

flachance — Tue, 13 Feb 2024 16:48:28 GMT

Looks like the issue was with HTTP/2. TAC advised to disable it with

ckp_regedit -a SOFTWARE\\CheckPoint\\FW1 IGNORE_ALPN_EXTENSION 1
cpstop;cpstart

Although HTTP/2 is supposed to be supported, it did fix our issue.