topic Re: web filtering with https inspection disabled in Firewall and Security Management

web filtering with https inspection disabled

pedkha1 — Fri, 18 Oct 2019 17:10:02 GMT

Hello

I want to do web filtering for my wifi guest users and but it doesent work.

https inspection disabled for the Guest subnet so how can i achieve it without https inspection

I added below rule to WF and still i can see traffic is passing through

Re: web filtering with https inspection disabled

PhoneBoy — Fri, 18 Oct 2019 23:18:51 GMT

Not sure what happened to the rule you're using.
In any case, please describe what you expect to happen versus what is actually happening.
If the traffic is being accepted when it should be dropped (or vice versa), what rule is it being accepted on instead and what is that rule?
Also what version/JHF level?

In general, if you are doing App Control/URL Filtering without HTTPS Inspection, R80.30 will be a much better choice as we can filter on Verified SNI.

Re: web filtering with https inspection disabled

pedkha1 — Sat, 19 Oct 2019 17:19:29 GMT

Hello

thanks for the answer, we are at sw level r80.20M1 and i expect to be dropped in place of accept.

i simply want to filter harmful sites for a subnet that belong to guest users.

Re: web filtering with https inspection disabled

PhoneBoy — Sat, 19 Oct 2019 18:06:54 GMT

The more specifics you can provide about the rule, the sites actually being accessed, etc, the more we can help.

R80.20.M1 is not a gateway release, what about your gateway?
Also, we do not jumbo hotfixes for R80.20.M1 and highly recommend upgrading to R80.30.

Re: web filtering with https inspection disabled

HeikoAnkenbrand — Sun, 20 Oct 2019 20:51:56 GMT

Hi @pedkha1,

R80.30/R80.20 with enabled HTTPS interception:

If the https interseption is enabled, the parameter host from http can be used for the url because the traffic is analyzed by active streaming. Check Point Active Streaming (CPAS) allow the changing of data, we play the role of “man in the middle”. CPAS breaks the connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.). An application is register to CPAS when a connection start and supply callbacks for event handler and read handler. Several protocols uses CPAS, for example: HTTPS, VoIP (SIP, Skinny/SCCP, H.323, etc.), Security Servers processes, etc. CPAS breaks the HTTPS connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.)

More read here: R80.x Security Gateway Architecture (Content Inspection)

R80.30/R80.20 without enabled HTTPS interception:

If the https interseption is disabled, SNI is used to recognize the virtual URL for application control and url filtering.

More read here: URL Filtering using SNI for HTTPS websites.pdf

Re: web filtering with https inspection disabled

pedkha1 — Mon, 21 Oct 2019 16:28:44 GMT

thanks for the email and document.

the reason i didn't upgrade to r80.30 IS because when we upgraded to R80.20 ,we face too many issues and software bugs and i am not sure if R80.30 is stable at this point or not.

so using SNI is the best idea for my question

do you know if R80.30 has the same issues like R80.20 ?

Re: web filtering with https inspection disabled

PhoneBoy — Thu, 24 Oct 2019 17:18:59 GMT

R80.30 is the generally recommended release at this point, particularly with the latest recommended JHF.

Re: web filtering with https inspection disabled

pedkha1 — Thu, 24 Oct 2019 17:20:52 GMT

thanks and great