topic Re: first 8KB data are passing gateway in General Topics

first 8KB data are passing gateway

ZaferGr — Thu, 16 May 2024 06:55:51 GMT

When Firewall are starting traffic with random port without access rule, we saw 3 way handshake and 8KB data are passing gateway. after 8kb traffic , check point gateway are blocking.

Re: first 8KB data are passing gateway

_Val_ — Thu, 16 May 2024 07:17:29 GMT

Product version, setup and policy details, protocot type?

Re: first 8KB data are passing gateway

ZaferGr — Thu, 16 May 2024 10:12:50 GMT

Hello Val,

That is a appliance on R81.10

And problem happened over app&url blade.

For example, at the bottom you have the drop rule for Facebook. Above this rule there is http or https permission. Even if the firewall is dropped, when viewed with Wishark, the 8kb packet is seen to have passed. and this package may contain Iban information.

Re: first 8KB data are passing gateway

_Val_ — Thu, 16 May 2024 10:21:46 GMT

IBAN on facebook? Are you serious?

Where do you do traces? On the client, or on the FW?

Also, you do realize that to discover an application with HTTPS Inspection in place, you do need to complete the TLS handshake, right?

Re: first 8KB data are passing gateway

ZaferGr — Thu, 16 May 2024 11:08:55 GMT

Just an example 😄 of course didn't on facebook.

Yes TLS handshake was completed. But you can focus on why checkpoint passing first 8 kb packet.

It looks like a workflow of firewall. Maybe reason is related with Protocol signature. Do you have any idea?

Re: first 8KB data are passing gateway

_Val_ — Thu, 16 May 2024 11:48:48 GMT

I am still trying to understand the original statement. You said, according to wireshark, 8kb of traffic passed. Where did you run the whireshark? Client side, server side, FW itself? There is not enough info to answer your question properly.

All I can say at this point, the traffic passed seems to be related to HTTPSi validation of the application to block.

Other than TLS handshake (not TCP handshake which is part of communication, but should not be as big as 8K), no actual data should pass. TLS handshake only includes certificate validation and authentication.

Re: first 8KB data are passing gateway

ZaferGr — Thu, 16 May 2024 12:19:12 GMT

Thanks for answers Val 🙂

Your last said include an answer for help me.