topic Re: Check Point Can Detect & prevent Domain Fronting Attack technique in General Topics

Check Point Can Detect & prevent Domain Fronting Attack technique

MarcuzShinz — Tue, 26 Nov 2024 13:10:29 GMT

Dear Everyone,

Recently I noticed Domain Pronting attack technique is coming back, can Check Point Firewall prevent it? What features need to be enabled?

Re: Check Point Can Detect & prevent Domain Fronting Attack technique

the_rock — Tue, 26 Nov 2024 13:15:48 GMT

https://support.checkpoint.com/results/sk/sk145112

Re: Check Point Can Detect & prevent Domain Fronting Attack technique

the_rock — Tue, 26 Nov 2024 13:24:22 GMT

Btw, its enabled by default, but if you wish to change it, you can run below.

Andy

****************************

[Expert@R82:0]# fw ctl get int reject_domain_fronting_conns
reject_domain_fronting_conns = 0
[Expert@R82:0]# fw ctl set -f int reject_domain_fronting_conns 1
"fwkern.conf" was updated successfully
[Expert@R82:0]#

Re: Check Point Can Detect & prevent Domain Fronting Attack technique

MarcuzShinz — Tue, 26 Nov 2024 13:27:07 GMT

Dear the_rock,

Thansk for your response, beside, Do we need any additional features to prevent this attack method?

Re: Check Point Can Detect & prevent Domain Fronting Attack technique

the_rock — Tue, 26 Nov 2024 13:30:42 GMT

Hi Marcus,

Does not appear so. I also checked inspection settings, as well as IPS protections, could not find anything about it. Plus, does not mention anything extra in the sk either.

Andy

Re: Check Point Can Detect & prevent Domain Fronting Attack technique

PhoneBoy — Tue, 26 Nov 2024 20:18:20 GMT

I assume this is part of Verified SNI support.
Doing anything related to SNI likely requires at least App Control (part of NGFW, NGTP, and NGTX licenses).