topic https url redirection in Firewall and Security Management

https url redirection

gema_adhan — Wed, 17 Oct 2018 00:22:00 GMT

I got an request to do URL redirection on my customer's site. they are asking me to redirect https://some.sites.com/someurl to https://some.sites.com/redirectoindex. I am sure this can be done by modifying Htaccess on the server itself. But we dont take any risk on production server, so we tried to manipulate it on the checkpoint gateway. At first i think it is possible to be done and i've tried sk40348, and the fact... this SK is intended only work on http. does anyone have experience about this? if so, i hope you can share the answer with us. FYI.. we are using gaia R77.30 as Management Server.

Thanks A lot..

Re: https url redirection

Dor_Marcovitch — Wed, 17 Oct 2018 06:48:45 GMT

What kind ofntraffic is it? Traffic incoming from the internet to your organization? Or from your organization to the internet?

Is it a temporary confoguration or not because soon r77.30 will be end of supplort and you will need to upgrade to r80

Except for the web server and the checkpoint what other security solution do you have involvong this website

This is needed only for a direct http request for this uri or rewriting of links is needed?

Re: https url redirection

gema_adhan — Thu, 18 Oct 2018 03:45:53 GMT

Hi Marcovitch Thanks for your responses.

What kind ofntraffic is it? Traffic incoming from the internet to your organization? Or from your organization to the internet?

the traffic is incoming traffic that is coming from internet

Is it a temporary confoguration or not because soon r77.30 will be end of supplort and you will need to upgrade to r80

it would be permanent configuration, yeah we know it, R77.30 will be end of support next year, but most of our customer is using R77.30

Except for the web server and the checkpoint what other security solution do you have involvong this website

i think there is no other security device between the server and our checkpoint gateway. The server reside on DMZ segement on our checkpoint gateway,

This is needed only for a direct http request for this uri or rewriting of links is needed?

i think both soultion can be applied. because we just need to hide https://some.sites.com/someurl from interenet but still allowing it to be accessed from internal network.

Re: https url redirection

PhoneBoy — Fri, 19 Oct 2018 23:20:14 GMT

That SK refers to the HTTP Security Server, which definitely does not support HTTPS.

To do this with HTTPS, I believe you can do something like:

Enable HTTPS Inspection for the inbound traffic (means getting the HTTPS certificate used for the webserver)
Create an application that refers to https://example.com/uri-to-redirect
Create a UserCheck action that redirects to https://example.com/redirect-to-uri (this is an option with a UserCheck action)
Create a rule that refers to this application and with action Drop and the UserCheck action you created.

Re: https url redirection

gema_adhan — Wed, 24 Oct 2018 09:11:57 GMT

Hi Dameon, sorry for late response. Thanks for your advice Dameon... I will ty it on my lab first before propose it the the user. and I will inform to you the result. But...Is there alternative way to accomplish this task instead of using https inspection because it will add the load of the gateway since there is limititation on the hardware that we used.

Re: https url redirection

PhoneBoy — Wed, 24 Oct 2018 13:53:51 GMT

It is technically impossible to do any sort of URL redirection without terminating the HTTPS connection.

Currently, the only way to do this is HTTPS Inspection.

Note: you can enable it for just inbound to the one site and be in "bypass" mode for everything else.