Https inspection best practice

[Ihenock1011]

Hi All,

I have a question about HTTPS Inspection. We want to restrict some of our client machines to only access specific websites that is needed for their work. we have create two rules on the Firewall and APP/URL blades and also We've installed the HTTPS certificate on the user machines and created two rules in the HTTPS rule base: one for inspection and one for bypassing. I'm unsure which rule should be set to inspect and which should be set to bypass: the allowed sites or the blocked ones.

Thanks,

[the_rock]

Its always like this...you bypass ALLOWED sites and inspect BLOCKED ones, thats it.

Andy

[the_rock]

@Ihenock1011 Let me know if you want to do remote, I have fully working ssl inspection lab on R81.20 jumbo 84.

Andy

[Lesley]

In order to bypass you need to inspect it. Unless you bypass made on IP address (that is almost never the case).

You always want to whitelist an url because it is more easy or a complete category like finance. 

But to know if you actually want to do the bypass firewall always has to do some inspection (not full).

Most of the time checking the certificate for the name is enough. 

[the_rock]

Not sure I understand your statement -> in order to bypass, you need to inspect it...sorry.

Andy

[Lesley]

It needs be able to check the certificate in order to see if it will hit a bypass rule. Unless you make the bypass based on IP. If you bypass based on URL it needs to do a check ithe cert n order to see if it will hit a bypass rule. 

https://support.checkpoint.com/results/sk/sk177983

https://support.checkpoint.com/results/sk/sk122158

Cannot find the exact SK but these explain it also a bit

[the_rock]

Certificate, right, of course. I had not tested in some time without https inspection, but if not enabled, it might be tricky to make bypass work, though that 2nd option from 1st sk may be a good option.

Andy

[_Val_]

There is a whole SecureKnowledge article dedicated to HTTPS Inspection Best Practices: sk108202. 

However, I am sure there are other things you need to consider before moving forward with HTTPSi policy.

HTTPS Inspection only allows you to see inside of TLS traffic. In most cases, you can effectively implement URL filtering (which you need to limit web access to specific sites only)  with something called HTTPSi Lite, a.k.a. HTTPS Filtering.

I suggest you review sk92743 and specifically HTTPS Filtering of the document before anything else.