topic Re: Inbound HTTPS Inpsection in Spark Firewall (SMB)

Inbound HTTPS Inpsection

HristoGrigorov — Fri, 06 Mar 2020 06:17:09 GMT

Any of you guys managed to configure inbound HTTPS Inspection on R77.20?

I want to do it between two internal hosts and I seem to miserably fail to achieve it 😁

Re: Inbound HTTPS Inpsection

MarioB_1 — Fri, 06 Mar 2020 10:43:58 GMT

Hi,

I am guessing, that you are asking for SMB appliances.

If the device is localy managed, than it is not supported. If it is centraly managed, than it is suppored.

More details you can find on bellow link.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105380

Regards,

Mario

Re: Inbound HTTPS Inpsection

TomTom — Fri, 06 Mar 2020 13:38:48 GMT

Update to R80.30!

Re: Inbound HTTPS Inpsection

PhoneBoy — Fri, 06 Mar 2020 16:01:26 GMT

The SMB appliances have a slightly different code base.
These cannot be upgraded to R80.30.

Re: Inbound HTTPS Inpsection

HristoGrigorov — Fri, 06 Mar 2020 16:05:51 GMT

Thanx for your comments guys. I forgot to mention I am asking about centrally managed 1470 appliance. I know it is supported, I just want someone that actually did it and can confirm it works.

Re: Inbound HTTPS Inpsection

Pedro_Espindola — Fri, 06 Mar 2020 17:17:37 GMT

It works fine from external hosts to internal.

I had many issues with internal to internal inspection. It seems besides presenting the server certificate the gateway also tried to generated an outbound certificate, doing a double inspection or something like this.

Re: Inbound HTTPS Inpsection

HristoGrigorov — Fri, 06 Mar 2020 17:23:50 GMT

Thanx Pedro, that confirms my observations. Unfortunately I have Nginx that serves few internal host so inspection before it is not possible.

Re: Inbound HTTPS Inpsection

Pedro_Espindola — Fri, 06 Mar 2020 17:33:12 GMT

So traffic hits the NGINX server before going to the gateway for ssl inspection?
For that to work, I think the interface that connects to the NGINX would have to be configured as external.

Re: Inbound HTTPS Inpsection

HristoGrigorov — Fri, 06 Mar 2020 17:44:33 GMT

INTERNET --> CPFW --> NGINX --> WEB 1 .. N

Each WEB server has its own certificate.

Re: Inbound HTTPS Inpsection

Pedro_Espindola — Tue, 10 Mar 2020 19:28:56 GMT

What about using wildcard certificates or multiple alternate names?

Re: Inbound HTTPS Inpsection

HristoGrigorov — Wed, 11 Mar 2020 04:23:19 GMT

Not an option unfortunately. And I am not sure it is supported on SMB.

Re: Inbound HTTPS Inpsection

Pedro_Espindola — Wed, 11 Mar 2020 14:49:18 GMT

Then I guess you'll need to have NGINX in a separate network defined as EXTERNAL and do this:

INTERNET --> CPFW --> NGINX --> CPFW (SSL inspection) --> WEB 1 .. N

Re: Inbound HTTPS Inpsection

HristoGrigorov — Wed, 11 Mar 2020 16:25:21 GMT

Yeah, that seems to be the only option for the time being. Thanx for giving that idea.