Gateway as HTTP/HTTPS proxy

[dianammar]

If the firewall is configured as HTTP/HTTPS proxy, and user is using for example SSH over HTTP, does the firewall proxy this traffic?

[PhoneBoy · Accepted solution]

While we support being configured as an (explicit) HTTP/HTTPS proxy, it's not a configuration we generally recommend.
Performance characteristics of proxy mode are substantially different and recommend you work with your Check Point SE to ensure your gateways are appropriately sized for such a configuration.

To answer your specific question, it entirely depends on how the SSH traffic is being tunneled as to whether it will be detected or not.
It also depends on whether you've enabled IPS and have the SSH over Non-Standard Port signature enabled (how such behavior is typically detected).

[dianammar]

So in general, can we limit any other protocols so they don't be passed by the proxy if they run over HTTP or HTTPS?

[PhoneBoy]

First of all, an HTTP proxy won't work if the HTTP that comes across it is not well formed.
Beyond that, yes, you can do further limiting with App Control and/or IPS.
You will probably also need HTTPS Inspection enabled as well. 

[Chris_Atkinson]

Yes, note protocol signatures may also be something to explore here e.g.

[rrbranco · Accepted solution]

On your case, would it be possible to consider using SSH DPI ?   

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/...

[dianammar]

Thanks everyone. We might consider SSH DPI for SSH traffic as well as inforcing policies with App control