topic Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy in General Topics

How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

SAT_S — Thu, 20 Jul 2017 08:26:15 GMT

Can Anybody PLease help me on this How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Thanks In advance

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Peter_Sandkuijl — Thu, 20 Jul 2017 09:21:34 GMT

This is documented here:

How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

SAT_S — Thu, 20 Jul 2017 09:30:56 GMT

yes but i am not able to view it as m getting this pop up

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Peter_Sandkuijl — Thu, 20 Jul 2017 11:17:14 GMT

As a picture typically says more than a thousand words:

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Andrejs__Андрей — Thu, 20 Jul 2017 11:23:07 GMT

hello Peter,

from sk "...Transparent - All HTTP traffic on specified ports and interfaces is intercepted and sent to a proxy..."

what does it (sent to a proxy) mean?
proxy as a deamon or external box?

thank You!
--
ak.

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

SAT_S — Thu, 20 Jul 2017 11:26:26 GMT

Thanks Peter , do i also need to configure any outbound or inbound policy against this..

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Peter_Sandkuijl — Thu, 20 Jul 2017 11:32:43 GMT

This means a process runs on the Check Point gateway that acts as a proxy. No 3rd party proxy would be required.

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

SAT_S — Thu, 20 Jul 2017 11:53:47 GMT

Thanks peter this was a great help....

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Peter_Sandkuijl — Thu, 20 Jul 2017 12:03:39 GMT

By checking the box, implied rules are put in place. You need to create rules as you usually would (internal lan > internet > http+https > accept). Take into account that the gateway creates the outbound (proxied) connection from the gateway and requires a DNS to resolve against.

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Andrejs__Андрей — Thu, 20 Jul 2017 12:16:40 GMT

and excellent work Sergei Shir and the SecureKnowledge Team!

they updated that sk110013!

"...and processed by the Proxy code in the Security Gateway..."

Thank You,

ak.

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

SAT_S — Sat, 22 Jul 2017 14:01:22 GMT

Hi peter

Bothering u again.. When creating a rule shud i select service as http 80, https 443 or http+https proxy 8080

SAT

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

PhoneBoy — Sat, 22 Jul 2017 16:58:45 GMT

http/https only should be sufficient.

The http-proxy service would allow access to other proxies, which I assume you don't want

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

SAT_S — Wed, 09 Aug 2017 11:14:46 GMT

what is the diffrence in transparent and non transparent proxy how they behave???

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

PhoneBoy — Wed, 09 Aug 2017 14:29:09 GMT

In non-transparent mode, you must explicitly define the gateway as a proxy in the browser (directly or with a proxy.pac file stored on a different webserver). Transparent mode intercepts HTTP traffic on the specified ports and interfaces and sends it through the proxy without explicit configuration on the client side.

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Tze_How_Tan — Sat, 19 Aug 2017 03:46:44 GMT

Hi Dameon,

in non-transparent mode, the security gateway will break the http/https connection (meaning 2 connections, from client to security gateway, security gateway to http/https web server).

1. my understanding is, in order to intercept the web traffic, the security gateway should listen to tcp/8080. when i login to the gaia os cli expert level, i did not see a listening port at tcp/8080 (netstat -an) or is there other commands to view this?

2. using http/https proxy, the gateway show spawn off a httpd process to intercept web request at tcp/8080. so may i know what is the process name and how to view this process from gaia os cli expert level?

Thank You

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

PhoneBoy — Sat, 19 Aug 2017 04:42:44 GMT

netstat doesn't show it because it's not a process that is listening on that port.

The firewall kernel intercepts the traffic and "folds" it to fwd, which listens on a number of ports (not tcp/8080).

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Tze_How_Tan — Sat, 19 Aug 2017 14:56:54 GMT

Thanks Dameon for the clarification.

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Olga_Kuts — Mon, 05 Feb 2018 15:50:55 GMT

If we can not test anything through netstat, how can we verify that the proxy works correctly? And how correctly to troubleshoot it?
In our case, we see logs, there are no deny actions, but the user does not have access to the Internet. On the test environment, I see this line:

[Expert@GW]# netstat | grep 8080
unix 2 [ ] DGRAM 8080 /tmp/pmsock

But in another environment I don't see it, and proxy doesn't work.

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

PhoneBoy — Mon, 05 Feb 2018 16:05:28 GMT

The most obvious first step would be to telnet to the firewall on port 8080 and see if it answers.

If it doesn't answer, then it might be a configuration issue or it might be something else.

Worth engaging the TAC in any case.

Re: How to configure Check Point Security Gateway as HTTP/HTTPS Proxy

Vladimir — Wed, 07 Feb 2018 15:37:42 GMT

I am a bit puzzled by the behavior of Transparent Proxy:

And yet, I could not verify that the proxy is working.

There are no log entries signifying its utilization and online proxy checkers do not indicate that the proxy is being used:

I have enabled the headers for explicit purpose of identifying that the proxy is working, but do not see any confirmations to that effect.