web filtering with https inspection disabled

[pedkha1]

Hello

I want to do web filtering for my wifi guest users and but it doesent work.

https inspection disabled for the Guest subnet so how can i achieve it without https inspection

I added below rule to WF and still i can see traffic is passing through

[PhoneBoy]

Not sure what happened to the rule you're using.
In any case, please describe what you expect to happen versus what is actually happening.
If the traffic is being accepted when it should be dropped (or vice versa), what rule is it being accepted on instead and what is that rule?
Also what version/JHF level?

In general, if you are doing App Control/URL Filtering without HTTPS Inspection, R80.30 will be a much better choice as we can filter on Verified SNI.

[pedkha1]

Hello

thanks for the answer, we are at sw level r80.20M1 and i expect to be dropped in place of accept.

i simply want to filter harmful sites for a subnet that belong to guest users.

[PhoneBoy]

The more specifics you can provide about the rule, the sites actually being accessed, etc, the more we can help.

R80.20.M1 is not a gateway release, what about your gateway?
Also, we do not jumbo hotfixes for R80.20.M1 and highly recommend upgrading to R80.30.

[HeikoAnkenbrand · Accepted solution]

Hi @pedkha1,

R80.30/R80.20  with enabled HTTPS interception:

If the https interseption is enabled, the parameter host from http can be used for the url because the traffic is analyzed by active streaming. Check Point Active Streaming (CPAS) allow the changing of data, we play the role of “man in the middle”. CPAS breaks the connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.). An application is register to CPAS when a connection start and supply callbacks for event handler and read handler. Several protocols uses CPAS, for example: HTTPS, VoIP (SIP, Skinny/SCCP, H.323, etc.), Security Servers processes, etc. CPAS breaks the HTTPS connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.) 

More read here: R80.x Security Gateway Architecture (Content Inspection) 

R80.30/R80.20 without enabled HTTPS interception:

If the https interseption is disabled, SNI is used to recognize the virtual URL for application control and url filtering.

More read here: URL Filtering using SNI for HTTPS websites.pdf 

[pedkha1]

thanks for the email and document.

the reason i didn't upgrade to r80.30 IS because when we upgraded to R80.20 ,we face too many issues and software bugs and i am not sure if R80.30 is stable at this point or not.

so using SNI is the best idea for my question

do you know if R80.30 has the same issues like R80.20 ?

[PhoneBoy]

R80.30 is the generally recommended release at this point, particularly with the latest recommended JHF.

[pedkha1]

thanks and great