Are proxy relevant when using https inspection

[flachance]

We’re looking at enabling the HTTP/HTTPS proxy functionality of the gateway but we are debating if it’s really worth it.

If you use HTTPS inspection, URL filtering and Application control, are you adding much in terms of security with using the gateway as an HTTP/HTTPS proxy?

Just curious about the community’s thoughts on this?

[the_rock]

Personally, I will say it depends how powerful your firewall is. From my experience, I would say https inspection adds 10-15% CPU usage.

[Wolfgang · Accepted solution]

My experience with Check Point gateway as a Webproxy ends up in using another specialized vendor for such a solution.

You‘ll get only a little bit more security but the Check Point proxy feature has not so much functionality and some limitations:

- some authentications are not working

- throughput is bad (SecureXL problem with proxy sk92482)

- NAT problematic in high traffic environments

- no forward proxies possible (example: sent website A to upstream proxy A and website B to upstream proxy B)

If you really need a proxy solution then go with a specialized product like SQUID or another one. If not using proxy you‘re fine and secure with your Check Point gateway and using all security features you mentioned.

How to configure Check Point Security Gateway as HTTP/HTTPS Proxy  shows most of the limitations and configuration.