topic Re: How URL filtering and Application control work in Checkpoint Firewall in Endpoint

How URL filtering and Application control work in Checkpoint Firewall

Yatiraj_Panchal — Mon, 06 May 2019 15:25:55 GMT

Hello Everyone,

I want to know about "how URL filtering and Application Control work in checkpoint Firewall:.

Thanks in advance!!!

Re: How URL filtering and Application control work in Checkpoint Firewall

PhoneBoy — Wed, 08 May 2019 03:16:13 GMT

I recommend reading the product documentation.
Assuming R80.20: https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_NextGenSecurityGateway_Guide/html_frameset.htm
The section on How to Create an Access Policy is where this is discussed and there is a whole section on App Control and URL Filtering.

Re: How URL filtering and Application control work in Checkpoint Firewall

Yatiraj_Panchal — Tue, 14 May 2019 12:55:01 GMT

This document provides only the configuration part, I'm looking for internal process or working of URL filtering and Application control.

How URL filtering and Application control work in Checkpoint Firewall

G_W_Albrecht — Tue, 14 May 2019 14:11:19 GMT

See sk92743: ATRG: URL Filtering and sk73220: ATRG: Application Control ! Here you find details about the the internal working of these two blades.

Re: How URL filtering and Application control work in Checkpoint Firewall

PhoneBoy — Tue, 14 May 2019 21:02:06 GMT

Most Software Blades use the same basic architecture.
Here are a couple of documents that show the packet flow in different ways:

https://community.checkpoint.com/t5/General-Topics/R80-x-Security-Gateway-Architecture-Logical-Packet-Flow/m-p/41747
https://community.checkpoint.com/t5/General-Topics/Simplified-Packet-Flow-document/m-p/16076

If you could tell us the actual problem you're trying to solve, we might be able to provide you with the documentation you need.

Re: How URL filtering and Application control work in Checkpoint Firewall

Yatiraj_Panchal — Thu, 16 May 2019 01:11:43 GMT

Thanks for the reply.

I want to know working of Application control and URL filtering.
Actually, you provide me packet flow.

I want to know like: if any application comes to Checkpoint then how checkpoint identify the application is Skype or Facebook or etc.
Is there any specific unique code for every application and same for the URL.
May be in URL is matching pattern, I think so.

Re: How URL filtering and Application control work in Checkpoint Firewall

Yatiraj_Panchal — Fri, 17 May 2019 14:09:21 GMT

Thanks for the solution, this is similar what I expect.

Re: How URL filtering and Application control work in Checkpoint Firewall

cwilliams — Thu, 16 Jan 2020 21:51:57 GMT

I believe the answer to your question is the following: Each known application has an associated Application ID. You are able to see the Application ID in the logs. In R80 you can modify the default view and add the column manually. Hope this helps.

Re: How URL filtering and Application control work in Checkpoint Firewall

PhoneBoy — Mon, 20 Jan 2020 22:10:29 GMT

Application Control uses signatures similar to IPS to determine what application a given traffic flow is.
URLs accessed do factor into this also.

URL Filtering is similar but it merely uses the URL and not other characteristics.
A different online database is consulted for the categorization in this case.