topic Re: Web Smartconsole and reverse proxies. in Firewall and Security Management

Web Smartconsole and reverse proxies.

martyn — Wed, 25 Jun 2025 16:30:24 GMT

Hi,

I would like to be able to setup behind a reverse proxy (portal vIP) browser access to multiple Provider-1 domains for access to the <...>/smartconsole service.

It is easy enough to configure a vIP/port (on https://100.64.20.27:801 say ) and to have that map through to a customer-1 domain (100.624.20.29/443. However when you then logon to that domain the Checkpoint web server (CPWS) at the end of the logon connection then sends the following:

{"data":{"loginToDomain":{"transportOtt":"107ad894-253d-4638-aa31-1c3e7d23172a","transportUrl":"https://100.64.20.29:443/smartconsole/transport","__typename":"LoginToDomainResponse"}}}

This of course breaks/redirects the browser connection from 100.64.20.27 to 100.64.20.29 and I would expect that the same happens for all of the domains that the Provider-1 is holding. This means that all the domain mgmt IPs are being pushed through to the browser, precluding any possability of being behind a reverse proxy.

Does anyone know how to go about achieving this?

Re: Web Smartconsole and reverse proxies.

PhoneBoy — Wed, 25 Jun 2025 23:03:15 GMT

Hmmm might be something to consider as a use case.
Tagging @Tomer_Noy

Re: Web Smartconsole and reverse proxies.

the_rock — Thu, 26 Jun 2025 00:36:06 GMT

I know one customer I work with was advised by their SE to submit RFE for this...not sure if anything ever came out of that, but this was 3 years ago.

Andy

Re: Web Smartconsole and reverse proxies.

Ofir_Calif — Sun, 29 Jun 2025 07:51:01 GMT

Hi,

Thank you for your question. Unfortunately, Web SmartConsole does not support reverse proxy configurations for MDS environments.

Best regards,
Ofir

Re: Web Smartconsole and reverse proxies.

martyn — Mon, 30 Jun 2025 09:35:55 GMT

Ofir,

Thanks for the confirmation. I would like to see CP correct this setup if possible. Being able to present a logs/policy view more widely without requiring the use of any specific binaries/applications i.e the MDG/SmartConsole would be very useful. But requiring that the internal Domain/CMA IPs have to be used by that wider distribution strikes me as a bit poor and not what I would hope to see from a Security Company.