Are you a member of CheckMates?
×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
Apologies, but I have to paste the entire SK here to get to the bottom of it.
Please scroll down to the highlighted sections and please help me understand the implications of these perls of wisdom:
----
R80.10 Configuration
- In order to make the Proxy Server to work on R80.10, an explicit rule should be created allowing traffic to the gateway itself on the proxy defined port.
- When using URL Filtering, an explicit rule should be created to match the URL categorization.
-----
(3) Limitations
HTTP/HTTPS proxy support is limited for the following features/configurations:
HTTPS traffic | Not supported in Transparent Proxy configuration when the HTTPS traffic ports are configured in the 'ports' section of the proxy configuration. | No active plans |
----
The following features/configuration are supported, but might require some adjustments:
HTTPS traffic | Supported in Non-Transparent Proxy configuration. | - |
-----
For what its worth, this seem to do the trick:
With Proxy configured thus:
And the proxy checker actually returns:
But since I have HTTPS inspection enabled, I have no means to discern if that traffic is being proxied or inspected inline which, in case of HTTPS may not be different anyhow, as the session is broken-down in two and the certificates will be substituted in both cases:
How to configure Check Point Security Gateway as HTTP/HTTPS Proxy
Top of Form
Rate This |
Bottom of Form
Solution ID | sk110013 |
Product | Security Gateway |
Version | R75.40, R75.40VS, R75.45, R75.46, R75.47, R76, R76SP, R76SP.10, R76SP.10_VSLS, R76SP.20, R76SP.30, R76SP.40, R77, R77.10, R77.20, R77.30, R80.10 |
OS | Gaia, SecurePlatform 2.6 |
Platform / Model | All |
Date Created | 14-Feb-2016 |
Last Modified | 22-Jan-2018 |
Solution
Table of Contents:
- Configuration in SmartDashboard
- Important notes
- Limitations
- Proxy errors
- Related documentation
- Related solutions
(1) Configuration in SmartDashboard
- Open the Security Gateway object you would like to configure as a Proxy.
- Go to HTTP/HTTPS Proxy pane:
- Check the box Use this gateway as an HTTP/HTTPS Proxy.
- Configure the Proxy settings:
- Proxy Modes
Two proxy modes are supported:
- Transparent - All HTTP traffic on specified ports and interfaces is intercepted and processed by the Proxy code in the Security Gateway. No configuration is required on the clients.
- Non Transparent - All HTTP/HTTPS traffic on specified ports and interfaces is intercepted and processed by the Proxy code in the Security Gateway. Configuration of the proxy address and port is required on client machines.
- Access Control
You can configure one of these options for forwarding HTTP requests:
- All Internal Interfaces - HTTP/HTTPS traffic from all internal interfaces is processed by the Proxy code in the Security Gateway.
- Specific Interfaces - HTTP/HTTPS traffic from interfaces specified in the list is processed by the Proxy code in the Security Gateway.
- Ports
By default, traffic is intercepted only on port 8080. You can add or edit ports as required.
- Advanced
You can configure proxy headers by clicking on Advanced... button.
- Proxy related headers - By default, the HTTP header contains the "Via" proxy related header. Clear this checkbox if you do not want to include it.
- X-Forward-For header (original client source IP address) - check this box to include the actual source IP address in the HTTP.
This header must be configured, if traffic will be forwarded to Identity Awareness Security Gateways that require this information for user identification. - Logging
The Security Gateway opens two connections (one connection with the client and one connection with the actual destination server), but only the Firewall blade can log both connections.
Other blades show only the connection between the client and the Security Gateway.
The "Destination" field of the log only shows the Security Gateway and not the actual destination server.
The "Resource" field shows the actual destination.
- Example:
- Install policy on the Security Gateway.
R80.10 Configuration
- In order to make the Proxy Server to work on R80.10, an explicit rule should be created allowing traffic to the gateway itself on the proxy defined port.
- When using URL Filtering, an explicit rule should be created to match the URL categorization.
(2) Important notes
- In order to maintain highest security, it is recommended to avoid selecting external interfaces as the relevant proxy interfaces.
- Check Point HTTP/HTTPS proxy is not a caching proxy (it does not cache commonly visited web pages to provide faster local access to hosts on the LAN).
(3) Limitations
HTTP/HTTPS proxy support is limited for the following features/configurations:
Feature / | Comments | Plans |
IPv6 | Proxy can be used, but not for IPv6 connections. In addition, refer to sk112816 - Check Point support for IPv4 / IPv6 Proxy. | Planned to be resolved in a future version. |
Span Port / | Proxy is not supported when this feature is enabled. Refer to sk98389. | No active plans |
VPN Site-to-Site | Proxy can be used, but not over VPN connections. Refer to sk93929. | Planned to be resolved in a future version. |
Mobile Access blade | Proxy can be used, but not over Mobile Access connections. | No active plans |
Anti-Spam & E-mail Security blade | Proxy is not supported when this feature is enabled. *The Content-based Anti-Spam is not supported with proxy (only the IP Reputation is supported) | No active plans |
Application Accounting | Not supported in Transparent Proxy configuration. | No active plans |
HTTPS traffic | Not supported in Transparent Proxy configuration when the HTTPS traffic ports are configured in the 'ports' section of the proxy configuration. | No active plans |
UserCheck | Users do not receive a UserCheck page for blocked HTTPS connections that pass through Proxy, but instead receive a message that the page could not be reached. | Planned to be resolved in a future version. |
NTLM authentication | Not supported in Proxy configuration. Refer to sk100214. | No active plans |
The following features/configuration are supported, but might require some adjustments:
Feature / | Comments | Integrated in |
VPN Remote Access with client E75.30 | The following configuration is required - add both internal and external interfaces to 'Specific Interfaces' setting in HTTP/HTTPS Proxy properties. | - |
UserCheck | UserCheck block page message is not shown when Security Gateway is configured as HTTP Proxy. To resolve the issue, add the portal IP address to the proxy exceptions list in your web browser, or use a proxy PAC file to exclude the portal from the connections that require a proxy. This allows the client to connect directly to the portal, without going through the proxy feature. Refer to sk72100. | - |
Bridge mode | The following configuration is required - you must configure an IP address on the bridge interface. | - |
Cluster with Cluster Virtual IP address on a different subnet than the member's physical IP addresses | In case you encounter connectivity issues, contact Check Point Support to get a Hotfix for this issue (Issue ID 01223637). | R76 and above |
Application & URL Filtering with a single interface | When Security Gateway is configured as HTTP/HTTPS Proxy with a single interface, define the relevant rules in 'Application & URL Filtering' policy as follows: Source - 'Any'; Destination - 'Any'. Refer to sk80340. | - |
"Page not found" error | Error is shown when Security Gateway is configured as Non-transparent Proxy, if the same site is accessed on more than one destination port. Contact Check Point Support to get a Hotfix for this issue (Issue ID 01134342). | R75.47, |
Ports Leak in ClusterXL HA | If ClusterXL in High Availability mode is used as Proxy in Non Transparent mode, then NAT kernel table 'fwx_alloc' on the Standby cluster member has significantly more entries than on the Active cluster member. "NAT hide failure - no available port for hide NAT" logs in SmartView Tracker will appear. | R77 and above |
HTTPS traffic | Supported in Non-Transparent Proxy configuration. | - |
Additional notes:
- By default, Check Point Security Gateway does not support Reverse Proxy Functionality.
For Capsule Docs Reverse Proxy, refer to:- sk102973 - Check Point Capsule Docs - 3rd-party Reverse Proxy Server
- sk103706 - Capsule Docs On-Premises vs. Capsule Docs managed in the Cloud
- sk105123 - Check Point Capsule Docs, Endpoint Security and Remote Access VPN E80.61 / R77.20.01
- sk108375 - Check Point Capsule Docs, Endpoint Security and Remote Access VPN E80.62 / R77.30.01
- On 41000 / 61000 Security System - Proxy connections will be dropped during failovers (due to the fact that such connections are handled as a Local Connection, which has no backup) (Issue 02331051).
(4) Proxy errors
Below is a summary of proxy errors as it is seen in browser and in logs.
Error | Browser | Log |
DNS failure, no connectivity to DNS server | Gateway Timeout The requested URL couldn't be resolved | Reject Proxy: DNS timeout/error; Connection was rejected due to DNS timeout or error |
DNS server is available but no record for the URL request | Gateway Timeout The requested URL couldn't be resolved | Reject Proxy: Internal error; Connection was rejected due to internal error |
DNS server is available, record for URL also available but no Internet connection | This web page is not available ERR_TUNNEL_CONNECTION_FAILED | Reject Can't connect to server |
HTTP server failure, no connectivity to HTTP server | Gateway Timeout The requested URL couldn't be resolved | Reject Can't connect to server |
HTTPS server error "500/404" - usually it indicates on a problem with the HTML code or page not found | Server error 500 | Accept |
Server Reset: Server is up and running but not listens to HTTP/S ports. Can happen after reboot or internal server errors | Server error 502 | Accept |
Authentication failure: wrong credential in a password authentication | Unauthorized The server could not verify that you are authorized to access the document requested. | Accept |
(5) Related documentation
- R77 versions IPS Administration Guide - chapter "Monitoring Traffic" - section "HTTPS Inspection" - sub-section "HTTP/HTTPS Proxy"
- R77 versions Threat Prevention Administration Guide - chapter "Using Threat Prevention with HTTPS Traffic" - section "HTTPS Inspection" - sub-section "HTTP/HTTPS Proxy"
- R77 versions Application Control and URL Filtering Administration Guide - chapter "Managing Application Control and URL Filtering" - section "HTTPS Inspection" - sub-section "HTTP/HTTPS Proxy"
(6) Related solutions
- sk112816 - Check Point support for IPv4 / IPv6 Proxy
- sk92482 - Performance impact from enabling HTTP/HTTPS Proxy functionality
- sk101395 - How to configure Proxy Chain on a Check Point Security Gateway defined as Proxy
- sk104639 - Connection from a Client to a Server does not work when both Client and Server are NATed ...
- sk104639 - Mobile Access R77.30 Reverse Proxy
- sk111171 - Security Gateway in HTTP/HTTPS Proxy mode sends TCP RST packet in response to TCP SYN pac...
- sk112939 - Application Control and URL Filtering blades do not work when Security Gateway is configu...
Applies To:
- This SK replaces sk98559
I've configured WPAD via DHCP and serve a central PAC file which excludes the security gateway. Workstations subsequently use an explicit proxy configuration but UserCheck redirection is not working in Google Chrome, Edge and Internet Explorer. Is this an issue I should open with TAC or do I need to do something to get the browser to honor the redirect?
The following is a packet capture from the office router sitting in between the workstation and the security gateway:
The browser appear to simply ignored the response. I'm able to see the User Check message if I manually type it in to the browser and it's not sent to the security gateway via the proxy protocol.
PS: Running R80.10 management and security gateway.
I do recall encountering similar issues in the past, some of them may even be listed in this thread.
Did you try it with these settings enabled in the HTTP/HTTPS Proxy / Advanced properties?
You may not want to leave those permanently turned-on, but may be it will help the gateways track the decoupled log events better.
I really would like for someone from Check Point to comment on the issue of tracking web access via proxies with clearly identified resources.
I can confirm that the proxy connections are not being logged properly.
with the layer's blades being:
And the gateway configured:
Proxy functionality verified:
Log's Resource and the URL columns remain empty:
cross-referencing this thread:
HTTPS inspection real life examples and caveats in R77.30 and R80.10
As I showed in the screenshots below I believe using the CP as a proxy works perfectly fine for me.
Possibly the findings from this chat that Resource tracking doesn't work is because of a bug (?) that there are two "Resource" columns (see screenshot above) and the one that is displayed in the previous screenshots was the wrong one?
