SSL Interception and offload to Proxy

JaySon_2021 — Wed, 20 Jan 2021 19:36:49 GMT

Currently we have a proxy that is performing SSL Interception. This causes high CPU load so we want to move SSL Interception off of the Proxies. I know that Checkpoint r80x does this but is there a way to expose/decrypt the SSL traffic on the firewall, send it to the proxy to be evaluated against the proxy policy and then send it back to the firewall and re-encrypted on the Checkpoint?

Re: SSL Interception and offload to Proxy

PhoneBoy — Thu, 21 Jan 2021 02:00:50 GMT

Check Point has a Mirror and Decrypt feature from R80.20 and up.
With this feature configured, you can either mirror traffic unencrypted or encrypted to a specific port on your gateway.
It is meant for a third-party Recorder or Packet-Broker that operates in monitor (promiscuous) mode to accept the mirrored and (possibly) decrypted traffic.
That means it won't work for your desired use case.

You realize Check Point can do App Control/URL Filtering too, right?
If you're having it decrypt the traffic, why not have it perform access control and threat prevention on it as well?

topic Re: SSL Interception and offload to Proxy in General Topics

SSL Interception and offload to Proxy

Re: SSL Interception and offload to Proxy