topic Re: HTTPS inspection block page issue in Firewall and Security Management

HTTPS inspection block page issue

the_rock — Thu, 26 Aug 2021 00:21:01 GMT

Hey everyone,

I hope someone can shed some light on this and provide some suggestions : ). So, here is the situation.

Customer has R81 mgmt and R80.40 jumbo 120 HA cluster. All works fine, but for some odd reason, with https inspection enabled, pages are blocked as per desired categories, BUT, user check block page seems to work super random. So say you go to gambling site, it gets blocked on chrome, but not on safari on mac...then on windows, its also very random, really depends site you go to if blocked page notification comes up or not.

We verified all the rules, logs show correct action and categories, so Im really not sure how to troubleshoot this. We do have TAC case, but wanted to do proper testing myself first.

Not sure if this info is worth much, but say if you try facebook.com, it simply shows connection was reset, yet log shows facebook is blocked according to right rule.

If someone could give any suggestions/guidance on this, would be greatly appreciated!!

Thanks as always.

Re: HTTPS inspection block page issue

PhoneBoy — Thu, 26 Aug 2021 01:20:12 GMT

All of that sounds like some pages are NOT getting HTTPS Inspection applied as that is required for the block page to show up.
If HTTPS Inspection isn't enabled, or isn't happening for some reason, the only option to block a connection is a TCP RST.

Re: HTTPS inspection block page issue

the_rock — Thu, 26 Aug 2021 01:30:28 GMT

I agree with you 100%, but the question is why...any good approach to this behavior?

Thanks as always.

Re: HTTPS inspection block page issue

PhoneBoy — Thu, 26 Aug 2021 01:39:52 GMT

If it were me, I'd probably be looking at debugging wstlsd.
TAC may have some other suggestions as well.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105559&partition=Advanced&product=HTTPS

Re: HTTPS inspection block page issue

the_rock — Thu, 26 Aug 2021 01:41:48 GMT

That sounds good...I may call into TAC tomorrow to see if they have any other suggestions. Tx!

Re: HTTPS inspection block page issue

Teddy_Brewski — Wed, 09 Apr 2025 13:18:52 GMT

Hi @the_rock

Do you recall any tips from TAC?

We're experiencing the same(?) issue with 1555 SMB appliances running R81.10.17 (996004508) with Application Control and URL Filtering blades enabled. HTTPS Inspection is not enabled, but we do have "Categorize HTTPS websites" checked.

Accessing http websites that fall into a blocked category results in a blocked page -- no issues here.

Accessing the same website over https doesn't produce the blocked page, but rather Connection Reset error in the browser. Also, there is some random behavior observed when nothing is blocked with certain browsers.

Logs do show correct action and category.

Thanks!

Re: HTTPS inspection block page issue

the_rock — Wed, 09 Apr 2025 13:25:42 GMT

This was a while ago, but I remember it worked fine after R81 upgrade, no issues. I would say you definitely need ssl inspection on for this to work right.

Andy

Re: HTTPS inspection block page issue

Tom_Hinoue — Wed, 09 Apr 2025 14:10:13 GMT

For locally managed SMBs, we have confirmed this issue occurs in R81.10.15/R81.10.17 and a SR is opened to TAC.
A hotfix should be available now for this issue, so if interested open a case to TAC and they should be able to assist 🙂
If you need the SR number, you can DM me and I will be happy to help.

Re: HTTPS inspection block page issue

Teddy_Brewski — Wed, 09 Apr 2025 17:00:07 GMT

Thank you @Tom_Hinoue ! Good to know we're not alone. 🙂 Going to DM in a second.

Re: HTTPS inspection block page issue

Tom_Hinoue — Wed, 09 Apr 2025 17:35:17 GMT

gotcha. Will reply in DM regarding what I know.

Re: HTTPS inspection block page issue

PhoneBoy — Wed, 09 Apr 2025 19:44:14 GMT

To show a block page, we need to issue an HTTP Redirect to the UserCheck portal.
For HTTPS connections, this is impossible to do unless HTTPS Inspection is enabled.

Re: HTTPS inspection block page issue

the_rock — Wed, 09 Apr 2025 21:24:15 GMT

@Teddy_Brewski What @PhoneBoy said is 100% correct. Think of the fw as MITM (man in the middle) in this case...if ssl inspection is off, there is literally nothing to "intercept".

Andy

Re: HTTPS inspection block page issue

the_rock — Wed, 09 Apr 2025 21:28:19 GMT

On another note, but in the same context, check out what @_Val_ said on November 23rd, 2021 in below post, its perfect explanation.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Categorize-HTTPS-Websites/m-p/134729/emcs_t/S2h8ZW1haWx8dG9waWNfc3Vic2NyaXB0aW9ufEtXQzJBQUFSS0w3WDNXfDEzNDcyOXxTVUJTQ1JJUFRJT05TfGhL#M20231