topic Re: Maestro HTTPS Inspection in Hyperscale Firewall (Maestro)

Maestro HTTPS Inspection

jnra — Mon, 23 Jan 2023 08:04:00 GMT

We have a single gateway acting as a perimeter firewall and a maestro setup with 1 security group. Both are being managed by a Single SMS. Our testing aims to access Facebook but block Facebook-Posting. This requires HTTPS inspection and we enabled it on both gateway and maestro.

Behind the gateway we have a test PC and it is working properly. Facebook posting is blocked, However, on the test PC behind Maestro, it's not working. Please see attached images for reference.

Anyone experienced this before? Thanks in advance.

Re: Maestro HTTPS Inspection

MartinTzvetanov — Mon, 23 Jan 2023 14:22:01 GMT

Maestro logs say Unreached OSCP, which for me means the certificate is not recognized which means GW behind Maestro doesn't decrypt the traffic. Dig in this direction.

Re: Maestro HTTPS Inspection

PhoneBoy — Tue, 24 Jan 2023 00:28:05 GMT

Did you check: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk178625&partition=Advanced&product=Quantum

Re: Maestro HTTPS Inspection

jnra — Tue, 24 Jan 2023 01:03:32 GMT

Yes. I tried getting the current value with fw ctl get command but I'm getting an error. Will update you once I get to work on our setup later.

Re: Maestro HTTPS Inspection

jnra — Tue, 24 Jan 2023 01:22:21 GMT

I performed sk178625 and change the value of appi_urlf_ssl_cn_perform_hold_for_cert_validation from 0 to 1 but still I encountered the same issue. I still get lots of "Unreached OCSP" https validation.

I have opened a TAC case for this concern as well.

Re: Maestro HTTPS Inspection

Timothy_Hall — Tue, 24 Jan 2023 12:48:58 GMT

Do you have Layer 4 distribution enabled? It is by default...

Re: Maestro HTTPS Inspection

jnra — Wed, 25 Jan 2023 01:06:42 GMT

Yes. L4 mode was enabled. I also tried setting the interfaces distribution mode manually by setting external interface as network and internal interface as user.

Re: Maestro HTTPS Inspection

emmap — Wed, 25 Jan 2023 01:56:26 GMT

Is the connection being HTTPS Inspected on both the Maestro SG and the perimeter gateway? Double inspection is not supported, so either just do it on the perimeter gateway or make sure that you exclude the Maestro IPs and the networks behind the Maestro from inspection on the perimeter gateway,

Re: Maestro HTTPS Inspection

jnra — Wed, 25 Jan 2023 02:03:27 GMT

On my initial setup, Maestro SG is behind perimeter firewall. Currently, I have a direct internet connection for Maestro SG.

Re: Maestro HTTPS Inspection

jnra — Wed, 25 Jan 2023 03:01:49 GMT

Thank you everyone. the issue was resolved after blocking Quic and Quic Protocol.