Solved: Re: Outbound HTTPS Inspection through 3rd Proxy

Tim_Gadjiev_S · ‎2021-07-20

Dear mates,

I need a help with outbound HTTPS Inspection.

In my company we use 3rd party Proxy server for users Internet access. Inside and outside interfaces for this Proxy is located on ClusterXL. So i need to implement HTTPS inspection. I need to know which user go to one or the other Internet site/service. This need to know which user try to open Internet resources with viruses or threat. I try to apply HTTPS Inspection policy between Users and Proxy. It doesn't work. After that i try to apply HTTPS Inspection policy between Proxy and Internet. It works. But i faced with new problem. This Proxy server used by Linux users and another services which cannot work with HTTPS Inspection properly.

Why i am looking for solution where HTTPS Inspection policy should be between Users and Proxy server, because it is very scalable solution. In this implementation i can add or remove some networks for HTTPS Inspection. For example i can add Windows users networks and exclude Linux users or some one.

So i started to find solution about HTTPS Inspection and Proxy server. And i found that the Checkpoint HTTPS Inspection cannot work with NTLM and Kerberos authentication.

So my quesstion is. How can i implement HTTPS Inspection with 3rd party Proxy server, where i need to know which user go to one or the other Internet site/service?

P.S. in my company we cannot use Checkpoint as HTTP/HTTPS Proxy by internal position of the company.

P.P.S. Sorry for my English, it is not my native language.

TGS

Wolfgang · ‎2021-07-21

@Tim_Gadjiev_S If you want to see the original IP addresses of your clients in the connections from proxy to internet, your proxy has to add the „x-forwarded-for header“.

But from my experience with such a configuration the best is to do the inspection between clients and proxy and not between proxy and internet. Are you really sure your source and destination IPs in the https inspection rule are correct. Any NAT maybe?

And best for https inspection will be to go with version R80.40.

View solution in original post

PhoneBoy · ‎2021-07-20

A simple network diagram would be helpful.
When you say “it doesn’t work” what precisely do you mean?
Can you describe the behavior in detail?

Also, for “HTTPS Inspection cannot work with NTLM and Kerberos authentication” I’m pretty sure we can work with Kerberos since that is something Identity Awareness supports.

Also, please mention version/JHF in use.

Tim_Gadjiev_S · ‎2021-07-21

I cannot reply on below your question, i don't understand why. But i added all you requested information below my Post.

TGS

Are you a member of CheckMates?

Outbound HTTPS Inspection through 3rd Proxy