topic Re: Page works only when HTTPS inspected in Firewall and Security Management

Page works only when HTTPS inspected

xiro — Fri, 15 Mar 2024 10:13:57 GMT

Hi, I just faced an strange issue, which hasn't ever occured in my 10 years of working with Check Point.

We have a server that needs to access Apple resources. Sometimes it worked, sometimes it didn't.

The ruleset for NW & AppC are fine, everything is allowed.

We then realized that user privileges in HTTPS inspection ruleset caused the strange behavior.

Per Default: The server was bypassed -> with a bypass, it doesn't work.

As soon as a user logged in, it triggered an AR, which caused the connection to be inspected - and then it works.

We tried to analyze this, and definitely the behavior is the opposite of the behavior you'd usually expect:

A bypass doesn't work, an inspect works.

My only logical explanation would be, that the cipher/protocol client-settings of the internal server are not compatible with Apple - and that an "inspect" masks these settings to the outbound GW ciphers - and therefore "fixes" the connection.

But - the server is up-to-date, has proper settings, supports TLS1.2 & 1.3 with secure ciphers & everyhting else worked, except this one service.

Has anyone ever faced something like that or has an idea what could cause such a behavior?

Re: Page works only when HTTPS inspected

G_W_Albrecht — Fri, 15 Mar 2024 10:54:35 GMT

I would suggest to contact CP TAC to get the reason for this!

Re: Page works only when HTTPS inspected

the_rock — Fri, 15 Mar 2024 12:15:52 GMT

I had never heard of something like that myself. It usually works when site is bypassed in https inspection policy, not the other way around. Can you send some screenshots of how this is configured when it works? Just blur out any sensitive data.

Andy

Re: Page works only when HTTPS inspected

PhoneBoy — Fri, 15 Mar 2024 22:54:09 GMT

You can prove this is exactly what happens by taking a tcpdump in both situations (with and without HTTPS Inspection enabled for this server).
You should see the cipher suites and such used.