topic Https Inspection Bypass - checkpoint capsule connect in SASE and Remote Access

Https Inspection Bypass - checkpoint capsule connect

hw — Mon, 25 May 2020 13:18:24 GMT

Hello,

we use the Checkpoint Caspusle Connect Client (Cloud Firewall) with HTTPS Inspection enabled and wanted to call the URL https://www.xing.com. However when the cloud client is connected, we can't call this URL. We only get the notification, that the site is not available. When we disconnect the cloud client, we can call this URL without any problem.

So we tried to bypass this site from the HTTPS inspection (*.xing.com in the cloud portal) however this also doesn't work. So we tried to analyse the traffic with "Fiddler" and there we see that the HTTPS handshake to www.xing.com failed, because the stream was closed.

It seems that the https bypass not really works. Does anybody know how we can bypass the traffic to xing?

Best regards

Re: Https Inspection Bypass - checkpoint capsule connect

PhoneBoy — Mon, 25 May 2020 20:31:23 GMT

Recommend a TAC case.
I suspect (without having done the troubleshooting) that there is an incompatibility with TLS ciphers between this site and what is supported by the Capsule Cloud infrastructure.
In this case, the only way a bypass would work is if you bypass the site by IP address.

Re: Https Inspection Bypass - checkpoint capsule connect

hw — Tue, 26 May 2020 04:38:58 GMT

Thanks for the answer. I will open a checkpoint case.

Re: Https Inspection Bypass - checkpoint capsule connect

Bekir_Aldemir2 — Tue, 23 Jun 2020 17:35:40 GMT

Not sure if you solved the issue already but for others who may come across the same problem, Check Point Capsule Connect doesn't support IP addresses in https inspection bypass rules. The quickest way to solve this is to exclude the IP / URL from web management interface (cloud.checkpoint.com)