Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
HeikoAnkenbrand
Champion Champion
Champion
Jump to solution

R80.20 - SNI vs. enabled HTTPS Interception

R80.20+  with enabled HTTPS interception:

If the https interception is enabled, the parameter host from http header can be used for the url because the traffic is analyzed by active streaming. Check Point Active Streaming (CPAS) allow the changing of data, we play the role of “man in the middle”. CPAS breaks the connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.). An application is register to CPAS when a connection start and supply callbacks for event handler and read handler. Several protocols uses CPAS, for example: HTTPS, VoIP (SIP, Skinny/SCCP, H.323, etc.), Security Servers processes, etc. CPAS breaks the HTTPS connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.) 

More read here: R80.x Security Gateway Architecture (Content Inspection) 

 

R80.20+ without enabled HTTPS interception (SNI is used):

If the https interception is disabled, SNI is used to recognize the virtual URL for application control and url filtering.

More read here: URL Filtering using SNI for HTTPS websites.pdf 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
1 Solution

Accepted Solutions
HeikoAnkenbrand
Champion Champion
Champion

Yes! SNI works without enabled HTTPS decryption. If the https interception is disabled, SNI is used to recognize the virtual URL for application control and url filtering.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips

View solution in original post

8 Replies
PhoneBoy
Admin
Admin
Hi, just to make a small correction to the above, there are customer-specifix hotfixes for SNI support on R80.10 and R80.20.
Note that with customer-specific fixes you won't necessarily be able to use recent jumbo hotfixes.
R80.30 has this integrated, enabled by default, and we actually verify the SNI requested by the client.
It is by far the better option.
Til_Hall
Explorer

I'm a little bit confused!

Can SNI be used without enabled HTTPS encryption?

0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

Yes! SNI works without enabled HTTPS decryption. If the https interception is disabled, SNI is used to recognize the virtual URL for application control and url filtering.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
PhoneBoy
Admin
Admin
Only with JHF117 or above installed.
Otherwise, SNI is NOT used for App Control/URL Filtering.
0 Kudos
Andreas_Mang
Contributor
is this on the roadmap for R80.20SP as well? Any target JHF?
0 Kudos
Chris_Atkinson
Employee Employee
Employee

R80.20SP JHF Take 191 GA or above.

CCSM R77/R80/ELITE
Andreas_Mang
Contributor

is this on the roadmap for R80.20SP as well? Any target JHF?

PhoneBoy
Admin
Admin
It's planned for the near term, yes, but not familiar with the exact JHF it is planned.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events