topic Are proxy relevant when using https inspection in General Topics

Are proxy relevant when using https inspection

flachance — Mon, 31 May 2021 18:28:08 GMT

We’re looking at enabling the HTTP/HTTPS proxy functionality of the gateway but we are debating if it’s really worth it.

If you use HTTPS inspection, URL filtering and Application control, are you adding much in terms of security with using the gateway as an HTTP/HTTPS proxy?

Just curious about the community’s thoughts on this?

Re: Are proxy relevant when using https inspection

the_rock — Mon, 31 May 2021 19:21:56 GMT

Personally, I will say it depends how powerful your firewall is. From my experience, I would say https inspection adds 10-15% CPU usage.

Re: Are proxy relevant when using https inspection

Wolfgang — Wed, 02 Jun 2021 18:18:41 GMT

My experience with Check Point gateway as a Webproxy ends up in using another specialized vendor for such a solution.

You‘ll get only a little bit more security but the Check Point proxy feature has not so much functionality and some limitations:

- some authentications are not working

- throughput is bad (SecureXL problem with proxy sk92482)

- NAT problematic in high traffic environments

- no forward proxies possible (example: sent website A to upstream proxy A and website B to upstream proxy B)

If you really need a proxy solution then go with a specialized product like SQUID or another one. If not using proxy you‘re fine and secure with your Check Point gateway and using all security features you mentioned.

How to configure Check Point Security Gateway as HTTP/HTTPS Proxy shows most of the limitations and configuration.