Access from internet for URL path

[Sergey_Anikeev]

Hello colleague!

Please help me understand how to implement the following settings.

Our system
SMS Gaia R81.20
ClusterXL Gaia R81.10

Our Web resource has been published on the Internet and is available at (as an example)
https://web-site.com/

We want to leave access only for this path (from Internet)
https://web-site.com/folder/data/

and deny access along the path:
https://web-site.com/folder/catalog/

Is this possible to do using rules on the gateway?

[PhoneBoy · Accepted solution]

Yes, using a custom application/site and HTTPS Inspection (required to see the URLs accessed).

[Sergey_Anikeev]

Am I correct in understanding that the rule structure itself should look like this (as an example)?

P.S.

SSL inspections activated.

[the_rock]

That should work or what I always do is say you want to block anything facebook, I just put it as *facebook* in URL list.

Andy

[Sergey_Anikeev]

Unfortunately rule 1.1 does not work.
The traffic eventually goes through rule 1.2

[PhoneBoy]

Please show a full log card (mask sensitive data) where that happens (i.e. traffic matches 1.2).
Please also show the certificate used for the website in question when the traffic is accepted.

[Sergey_Anikeev]

[PhoneBoy]

That only answers the first question.
For the second question, we'll need to know what the actual site you're trying to configure blocking on versus what the certificate for that site says.

[Sergey_Anikeev]

[PhoneBoy]

You're probably in TAC territory now: https://help.checkpoint.com 

[the_rock]

Just do wildcard, it will work.

Andy

[Sergey_Anikeev]

I tried different options, but unfortunately it didn't solve the problem.

[the_rock]

If you are allowed to send me website in private message, so I can test it in the lab?

Andy

[Sergey_Anikeev]

I don't see how you can test this given that the site is located in our perimeter.
Or did I misunderstand the question?

[the_rock]

You got the answer from phoneboy, for this, you 100% need https inspection.

Andy

[Lesley]

URL is encrypted so what the other guys said I agree with. In this case it will be a 'reverse HTTPS inspection'.

So you need to intercept the traffic towards the public server