web sockets

[LazarusG]

Hi

What support can Checkpoint offer for web sockets.

I must admit I have not encountered them before in my networking career.

Our customer has a proxy product that cannot granularly filter them and sends everything uninspected.

They have on-prem gateways.

If they bypass their proxy can we leverage https inspection/apcl/url filtering logic in the on-prem gateways to apply security policy to ws:// and wss:// sites?

Will the cloud WAF product be able to do this?

Thanks

[Danny]

WebSockets are everywhere. Many WebUI's heavily make us of them. Interactive online games, like LittleWarGame, wouldn't work without wss. I've created several tools to tinker with those nifty sockets. They are the hidden engine of many online communications these days.

[PhoneBoy]

We support WebSocket in the context of Mobile Access Blade: https://support.checkpoint.com/results/sk/sk95311 
It appears CloudGuard WAF supports this also, but that's more for protecting the server side of this.

[LazarusG]

Thanks - the official comment from the proxy vendor was that web sockets require a forward and reverse proxy function due to the protocol having the ability to switch/upgrade mid stream: they couldn't do it as the appliance was a forward proxy only. I know there is an application definition in Checkpoint,  but it would be more about how to exempt the web socket traffic from the main web traffic on the proxy to send it somewhere else I guess. WAF is interesting. Anyway the issue has left my support queue so it someone else problem now 🙂

[PhoneBoy]

We do have reverse proxy functionality also, FYI: https://support.checkpoint.com/results/sk/sk110348