first 8KB data are passing gateway

[ZaferGr]

When Firewall are starting traffic with random port without access rule, we saw 3 way handshake and 8KB data are passing gateway. after 8kb traffic , check point gateway are blocking.

[_Val_]

Product version, setup and policy details, protocot type?

[ZaferGr]

Hello Val,

That is a appliance on R81.10

And problem happened over app&url blade. 

For example, at the bottom you have the drop rule for Facebook. Above this rule there is http or https permission. Even if the firewall is dropped, when viewed with Wishark, the 8kb packet is seen to have passed. and this package may contain Iban information.

[_Val_]

IBAN on facebook? Are you serious?

Where do you do traces? On the client, or on the FW?

Also, you do realize that to discover an application with HTTPS Inspection in place, you do need to complete the TLS handshake, right?

[ZaferGr]

Just an example 😄 of course didn't on facebook. 

Yes TLS handshake was completed. But you can focus on why checkpoint passing first 8 kb packet.

It looks like a workflow of firewall. Maybe reason is related with Protocol signature. Do you have any idea? 

[_Val_ · Accepted solution]

I am still trying to understand the original statement. You said, according to wireshark, 8kb of traffic passed. Where did you run the whireshark? Client side, server side, FW itself? There is not enough info to answer your question properly.

All I can say at this point, the traffic passed seems to be related to HTTPSi validation of the application to block. 

Other than TLS handshake (not TCP handshake which is part of communication, but should not be as big as 8K), no actual data should pass. TLS handshake only includes certificate validation and authentication.

[ZaferGr]

Thanks for answers Val 🙂 

Your last said include an answer for help me.