Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
flachance
Contributor

Are proxy relevant when using https inspection

We’re looking at enabling the HTTP/HTTPS proxy functionality of the gateway but we are debating if it’s really worth it.

If you use HTTPS inspection, URL filtering and Application control, are you adding much in terms of security with using the gateway as an HTTP/HTTPS proxy?

Just curious about the community’s thoughts on this?

0 Kudos
2 Replies
the_rock
Mentor
Mentor

Personally, I will say it depends how powerful your firewall is. From my experience, I would say https inspection adds 10-15% CPU usage.

0 Kudos
Wolfgang
Leader
Leader

My experience with Check Point gateway as a Webproxy ends up in using another specialized vendor for such a solution.

You‘ll get only a little bit more security but the Check Point proxy feature has not so much functionality and some limitations:

- some authentications are not working

- throughput is bad (SecureXL problem with proxy sk92482)

- NAT problematic in high traffic environments

- no forward proxies possible (example: sent website A to upstream proxy A and website B to upstream proxy B)

If you really need a proxy solution then go with a specialized product like SQUID or another one. If not using proxy you‘re fine and secure with your Check Point gateway and using all security features you mentioned.

How to configure Check Point Security Gateway as HTTP/HTTPS Proxy  shows most of the limitations and configuration.