topic Re: Can CheckPoint be Secure Web Gateway in General Topics

Can CheckPoint be Secure Web Gateway

HUNT_LEE — Wed, 29 Jan 2020 23:48:31 GMT

i have some web servers that i want to protect (the web servers is to provide public websites to users from the Internet).

Can Checkpoint be used as a Web Security Gateway? Can it protect inbound traffic from Internet with Layer 7 capabilities (with analytics)?

We would need to capability to block attacks on our web servers and be able to have visibility.

Cheers,

Hunt

Re: Can CheckPoint be Secure Web Gateway

PhoneBoy — Thu, 30 Jan 2020 04:07:56 GMT

Yes, many customers do exactly this with the NGTX package.
To see encrypted traffic, you can so enable SSL Inspection so the gateway can see unencrypted traffic.

Re: Can CheckPoint be Secure Web Gateway

HUNT_LEE — Thu, 30 Jan 2020 04:10:08 GMT

Hi PhoneBoy,
I have searched online and many said enabling IPS will requires lots of tuning and manpower.
Would you know any places where i can find some examples on how this can be done?
Cheers,
Hunt

Re: Can CheckPoint be Secure Web Gateway

Chris_Atkinson — Thu, 30 Jan 2020 04:15:22 GMT

For reference, please see: Next-Gen-Threat-Prevention-WAF-OWASP-Top-10-Comparison.pdf

Re: Can CheckPoint be Secure Web Gateway

Wolfgang — Thu, 30 Jan 2020 07:25:11 GMT

Hunt_Lee,

to enable the IPS protections for your webserver......

Enable the webserver option on your webservers host-object

configure the operating system and services running on these host

and finally you have to enable the IPS protections following your needs

IPS blade thas to be enabled and a profile has to be assigned via a TP rule to your webservers.

Wolfgang

Re: Can CheckPoint be Secure Web Gateway

HUNT_LEE — Fri, 31 Jan 2020 05:11:52 GMT

Hi Wolfgang,

The TP Rule, you are referring to the ones i attached? (Rule 4)

Am I correct in assuming that I will need to create a usual

Source: Any (public internet)

Destination: New_Web_Server

Services: HTTPS

By using these TP, would it create much of a performance hit on the checkpoint cluster?

Cheers,

Hunt

Re: Can CheckPoint be Secure Web Gateway

Wolfgang — Fri, 31 Jan 2020 06:44:29 GMT

Hunt,

yes, you can use the shown rule.

You need a TP rule which is catching your webserver, you can use a granular rule like you attached or you can use a TP rule with protection scope on any or your DMZ networks.

If IPS is already on the performance impact is marginal.

Wolfgang

Re: Can CheckPoint be Secure Web Gateway

HUNT_LEE — Fri, 31 Jan 2020 06:46:20 GMT

Thanks Wolfgang

Re: Can CheckPoint be Secure Web Gateway

PhoneBoy — Fri, 31 Jan 2020 20:51:27 GMT

We have something that can help with this.
It's discussed here: https://community.checkpoint.com/t5/IPS-Anti-Virus-Anti-Bot-Anti/Moving-from-Detect-to-Prevent-TechTalk-Video-Slides-and-Q-amp-A/td-p/71878