Best practice to exempt sites from HTTPS inspection

[Markus_Marquard]

Hi,

what is best practice to exclude sites - identified by hostname - from https inspection?

We cannot use host objects as the ip addresses behind the FQDNs can change without notice.

We would like to use FQDN (R80.10) objects, but unfortunately it seems they are NOT supported in HTTPS inspection policy. Is there a plan to implement this?

So we are ending up with creating custom URLs? But this will still have some impact on the (at least 1st) HTTPS connection to this destination as the firewall has to check the first packet for URL.

Any thoughts?

[Dor_Marcovitch]

If this "So we are ending up with creating custom URLs" works for you. Enable the flag for enhanced https inspection. This will enable the probing mechanism. And the first connection womt be dropped.

The probing mechanism.basiclly hold the session.. The fw open a new session to the server and check it's certificate. If it is to be bypassed it is just releasing the holded session

[Kyle_Danielson]

While enabling Probe Bypass(enhanced_ssl_inspection), will prevent the inspection of the first connection to hit the bypass rule, it's important to be aware that this will break connections to sites that require SNI.

Because we start the middle man so early on the connection with enhanced_ssl_inspection(on the SYN packet), we don't yet have the SNI from the client because it's contained in the Client Hello.

This will cause issues with servers that host multiple sites and require SNI like Cloudflare or other CDNs.

[Aaron_Pritchard]

This is a functionality problem i have also come across with regard to an issue in R80.10,

We had a fault whereby sites we set as bypass were still being inspected (the first packet) which was causing a breakdown between desktop and web server.

The HTTPS inspection still being 'legacy' is a big pain, as it still doesnt allow for applications and dynamic objects.

there are some decent threads on the probe bypass (the pros and cons). but here is the sk on the mechanism

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...