Blocking by HEADER LENGTH EXCEEDED

[Matlu]

Hello,

We are having problems with the consumption of a web service.
The user can't access a web site, and the event log tells us that it is because of "authorization' header length exceeded maximum allowed".

I have found a SK and reviewed it, but I would like to know if you would apply this SK as a recommendation, to "correct" our scenario (The SK focuses on another reason for blocking).

https://support.checkpoint.com/results/sk/sk171805

Maybe someone has dealt with a similar problem before, and can share their experience?

Regards.

[PhoneBoy]

I believe this SK would also apply in your situation as the root cause is the same (the relevant header is greater than permitted).
Or you can create an exception for this Core protection for the relevant server.

[Matlu]

Sorry,

But what do you mean by "create an exception"?

Is this done from the INSPECTION SETTINGS options?

Any reference to check, regarding your recommendation, please?

Greetings,

[PhoneBoy]

Not to be confused with an IPS/Threat Prevention exception.
https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SecurityManagement_AdminGuid...

[the_rock]

IPS exception, its under security policies and then custom policy. That was meant for @Matlu : - )

[Matlu]

Ok, I will check that option.

But this traffic that I have shown, is it related to "IPS"?

Because I don't see in the log, something that gives me an indication at a glance, that the IPS blade is the one who is blocking the traffic, haha. 😄

Maybe I'm "getting worse" with the view :'(

[the_rock]

Sorry, my bad mate, been long day. Below, attached the photo.

Andy