topic Domain objects in R80.40 https inspection policy in Firewall and Security Management

Domain objects in R80.40 https inspection policy

henryck — Mon, 26 Oct 2020 23:21:39 GMT

I am looking for a solution to applying inbound https inspection to web application proxies that secure external facing web servers with different certificates. I cannot find any SKs to indicate whether its supported to use domain objects (fqdn) or similar.

The issue we face is multiple sites are configured on the same proxy that then use different certificates. We NAT from a single public IP in our block, however when creating the https inspection policy using a network object this presents the configured certificate to clients, which in our case does not solve the issue.

In lieu of having to assign multiple IPs from our block to different sites, can anyone advise if they have faced similar issues and have found a solution?

Thanks!

Re: Domain objects in R80.40 https inspection policy

PhoneBoy — Mon, 26 Oct 2020 23:28:29 GMT

Not with domain objects, but with Custom Application/Site objects.
See: https://community.checkpoint.com/t5/Next-Generation-Firewall/Is-there-SNI-support-for-inbound-HTTPS-inspection-in-R80-20/m-p/53423/highlight/true#M1390

Re: Domain objects in R80.40 https inspection policy

henryck — Tue, 27 Oct 2020 04:49:16 GMT

Thanks, I'll give that a go. Is there any available SKs or documentation that get into this a bit more?

Re: Domain objects in R80.40 https inspection policy

PhoneBoy — Mon, 02 Nov 2020 05:39:15 GMT

The information in that thread came from R&D, as I recall, so it should be fairly accurate.
If you're having issues, let us know.

Re: Domain objects in R80.40 https inspection policy

henryck — Mon, 02 Nov 2020 05:56:51 GMT

Support confirmed bug in r80.40, to be patched in an upcoming JHF.

PRJ-9661,
PRHF-8304

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456&partition=Basic&product=All