topic Re: Outbound HTTPS Inspection doesn't work randomly in General Topics

Outbound HTTPS Inspection doesn't work randomly

denetworks — Tue, 16 Apr 2024 10:35:15 GMT

Hello,

We have enabled HTTPS inspection to outbound connection to Internet. We've imported root CA certificate from windows domain in checkpoint firewall. It works fine mostly but sometimes, user's browsers show certificate warning page. In these cases, the loaded certificate is empty, it doesn't have a subject name. If we reload the page, it shows the correct certificate from checkpoint firewall without any warning or error.

Could it be a bug or misconfig?

Thanks.

Re: Outbound HTTPS Inspection doesn't work randomly

PhoneBoy — Tue, 16 Apr 2024 15:50:37 GMT

What version/JHF on what hardware?
You may need TAC to assist in investigating this.

Re: Outbound HTTPS Inspection doesn't work randomly

the_rock — Tue, 16 Apr 2024 15:58:21 GMT

I dont believe thats a bug. I recall having that issue once working with a customer and we did have TAC case open for it, but out of the blue, one day all just started working fine without a single change or version upgrade.

I can tell you, having tested https inspection who knows how many times in the lab, it works really well in R81.20. If you need me to test anything, happy to do it, I actually have windows PC thats behind the lab cluster, with inspection running, so not a problem to do any test.

Best,

Andy

Re: Outbound HTTPS Inspection doesn't work randomly

denetworks — Thu, 18 Apr 2024 09:27:18 GMT

HI, the version is R81.10 take 335

Re: Outbound HTTPS Inspection doesn't work randomly

Lesley — Thu, 18 Apr 2024 12:01:39 GMT

please share cpinfo -y all output of problematic gateway. 335 is not correct take number.

Re: Outbound HTTPS Inspection doesn't work randomly

Alex- — Thu, 18 Apr 2024 12:07:14 GMT

335 is the baseline OS build, not a JHF Take.

Some-Gateway>show version all Product version Check Point Gaia R81.10 OS build 335 OS kernel version 3.10.0-957.21.3cpx86_64 OS edition 64-bit

Re: Outbound HTTPS Inspection doesn't work randomly

the_rock — Thu, 18 Apr 2024 12:24:52 GMT

Hey @denetworks ,

This is what we are referring to.

Andy

[Expert@cpazurecluster1:0]# cpinfo -y fw1

This is Check Point CPinfo Build 914000239 for GAIA
[FW1]
HOTFIX_R80_40_MAAS_TUNNEL_AUTOUPDATE
HOTFIX_GOT_TPCONF_AUTOUPDATE
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 53
HOTFIX_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE

FW1 build number:
This is Check Point's software version R81.20 - Build 024
kernel: R81.20 - Build 032

[Expert@cpazurecluster1:0]#