Application Control Issues with Apps using AWS S3

[Dominik_M]

Hi everyone,

since November last year we experience more and more applications we have allowed on our client's Check Point gateway (R81.20) not working anymore as the traffic is categorized as "Amazon S3" with the category "File Storage and Sharing".

"File Storage and Sharing" is gets blocked per policy.

We had this issue starting in November with Adobe Services and now also GoTo Webinar and Asana.

Is this a known issue or part of an overall behavior change when it comes to applications using Amazon S3?

Kind regards,

Dominik

[_Val_]

Are you working with TAC on that?

[Dominik_M]

We had a ticket open in the beginning of December which only told us to allow "Amazon S3" as well. We have opened a new ticket now.

I was wondering if maybe something has changed in general or if our client's installation might have an issue.

[the_rock]

Im thinking as workaround, you could add custom app sites to allow.

[Chris_Atkinson]

Which jumbo of R81.20 and was this observed with or without HTTPs inspection?

[Dominik_M]

It's currently on Take 99 and yes, HTTPS Inspection is inspecting the traffic.

[Chris_Atkinson]

Out of interest has this improved, I noticed an AppWiki update to Amazon S3 early Jan?

[Dominik_M]

It seems to be a persistent issue as we still need to allow "Amazon S3" but we also had some instances when it improved without us changing anything for that specific user group.

[the_rock]

I would try recommended jumbo 120, see if it makes any difference.

[Ilovecheckpoint]

I installed Take 120 and also on my case, storage category is blocked. As security stand point, to open all Amazon S3, via custom application or a recognised app, is too large. On the other end, to open a specific url on s3, could have as results, the page will not load if the web site storage has changed url, am I wrong? 

[the_rock]

Thats definitely true. Might then need to figure out sites that need to be added...I know thats easier said than done, but adding wildcard, probably not something that would work in this case.