topic Re: Do any Checkpoint appliances offer SSL offload? in General Topics

Do any Checkpoint appliances offer SSL offload?

phlrnnr — Thu, 04 Oct 2018 19:51:24 GMT

I understand that Check Point is a software company. But, since they sell their software on their own dedicated appliances, I was wondering if any of the appliances can do https encryption/decryption offload to a separate card/chip/asic so the CoreXL CPUs don't have to handle that burden? I know other vendors that require ssl inspection have these types of asics to reduce CPU processing burden. Just wondering if Checkpoint does this on any appliance models or is considering this?

I'd rather have CoreXL working hard at inspecting traffic and let something else worry about the encrypt/decrypt.

Re: Do any Checkpoint appliances offer SSL offload?

Timothy_Hall — Thu, 04 Oct 2018 20:09:40 GMT

This will soon be possible with the Falcon accelerator cards which are in EA right now as mentioned in the thread below by Dorit Dor‌:

Check Point R80.20 Now GA

If you'd like to join the EA program for this product I'm sure they'd love to hear from you. 🙂

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Re: Do any Checkpoint appliances offer SSL offload?

Sarah_Elie1 — Thu, 04 Oct 2018 21:47:07 GMT

Checkpoint has a partnership with Radware you can purchase a Radware appliance to do the ssl decryption and the Checkpoint gateways will focus on the security inspection. This is a link to the white paper.

https://www.checkpoint.com/downloads/product-related/solution-brief/sb-radware-checkpoint.pdf

Re: Do any Checkpoint appliances offer SSL offload?

_Val_ — Fri, 05 Oct 2018 12:57:36 GMT

Second that. With a pair of Radware appliances you can create something called "clear text sandwich". Radware will do encryption & decryption while CP GW can do decent inspection in the middle

Re: Do any Checkpoint appliances offer SSL offload?

Pablo_Barriga — Fri, 21 Jun 2019 09:18:41 GMT

Hello so far I tested that with Symantec SSL Visibility.

https://community.checkpoint.com/message/13951-symantec-visibility-appliance-netronome

Re: Do any Checkpoint appliances offer SSL offload?

Vato_Chantladze — Sun, 12 May 2019 11:07:30 GMT

Hi!

I see Check Point has an official partnership with Radware and this is the reason why there is only one solution brief file what describes Radware Alteon ADC SSL offloading capabilities with CP.

Otherwise, the same thing should work perfectly with other vendors, like Symantec SSL Visibility Appliance or for me, even better product, F5 with hardware SSL offloader.

Next step I plan to test deployment so-called "Burrito Design" configuration for an F5 SSL offloader with Check Point Appliance in L2 mode with NGTP.

Hope it will work, by design it should.

Vato

Re: Do any Checkpoint appliances offer SSL offload?

Vladimir — Sun, 12 May 2019 13:12:54 GMT

@Vato_Chantladze , please let us know your findings. I am interested in how it works out and what the final design looked like.

Regards,

Vladimir

Re: Do any Checkpoint appliances offer SSL offload?

Kim_Moberg — Thu, 30 Mar 2023 18:45:07 GMT

@Vato_Chantladze what was your findings using different brands for SSL offloading? What was your experience using Symantec vs. F5 SSL offloader. Any experience with Netscaler for SSL offloading?
Any guides available for setup?

Thanks

Kim