topic Re: Https inspection best practice in General Topics

Https inspection best practice

Ihenock1011 — Wed, 18 Sep 2024 12:53:17 GMT

Hi All,

I have a question about HTTPS Inspection. We want to restrict some of our client machines to only access specific websites that is needed for their work. we have create two rules on the Firewall and APP/URL blades and also We've installed the HTTPS certificate on the user machines and created two rules in the HTTPS rule base: one for inspection and one for bypassing. I'm unsure which rule should be set to inspect and which should be set to bypass: the allowed sites or the blocked ones.

Thanks,

Re: Https inspection best practice

the_rock — Wed, 18 Sep 2024 13:09:39 GMT

Its always like this...you bypass ALLOWED sites and inspect BLOCKED ones, thats it.

Andy

Re: Https inspection best practice

_Val_ — Wed, 18 Sep 2024 13:12:03 GMT

There is a whole SecureKnowledge article dedicated to HTTPS Inspection Best Practices: sk108202.

However, I am sure there are other things you need to consider before moving forward with HTTPSi policy.

HTTPS Inspection only allows you to see inside of TLS traffic. In most cases, you can effectively implement URL filtering (which you need to limit web access to specific sites only) with something called HTTPSi Lite, a.k.a. HTTPS Filtering.

I suggest you review sk92743 and specifically HTTPS Filtering of the document before anything else.

Re: Https inspection best practice

the_rock — Wed, 18 Sep 2024 14:13:45 GMT

@Ihenock1011 Let me know if you want to do remote, I have fully working ssl inspection lab on R81.20 jumbo 84.

Andy

Re: Https inspection best practice

Lesley — Wed, 18 Sep 2024 17:20:21 GMT

In order to bypass you need to inspect it. Unless you bypass made on IP address (that is almost never the case).

You always want to whitelist an url because it is more easy or a complete category like finance.

But to know if you actually want to do the bypass firewall always has to do some inspection (not full).

Most of the time checking the certificate for the name is enough.

Re: Https inspection best practice

the_rock — Wed, 18 Sep 2024 17:30:10 GMT

Not sure I understand your statement -> in order to bypass, you need to inspect it...sorry.

Andy

Re: Https inspection best practice

Lesley — Wed, 18 Sep 2024 18:08:14 GMT

It needs be able to check the certificate in order to see if it will hit a bypass rule. Unless you make the bypass based on IP. If you bypass based on URL it needs to do a check ithe cert n order to see if it will hit a bypass rule.

https://support.checkpoint.com/results/sk/sk177983

https://support.checkpoint.com/results/sk/sk122158

Cannot find the exact SK but these explain it also a bit

Re: Https inspection best practice

the_rock — Wed, 18 Sep 2024 18:13:09 GMT

Certificate, right, of course. I had not tested in some time without https inspection, but if not enabled, it might be tricky to make bypass work, though that 2nd option from 1st sk may be a good option.

Andy