Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
donnie
Explorer

Checkpoint able to view content of proxy tunnel

Hi all, 

I applied a application ACL which blocked all file sharing services on my perimeter firewall which is checkpoint 5600 firewall .

My internal clients uses cloud proxy (which does SSL inspection via man in the middle) to access the internet for web services (http and https).

Curently file sharing service is allowed on my cloud proxy since this is a new deployment and we are in the evaluation stage before applying any restriction or enforcement.

Hence i was suprised why my checkpoint firewall is able to detect and block my internal client access to google drive (via https) since there is no SSL inspection applied on my checkpoint firewall. The destination ip stated in the session tab of the log is the ip of my cloud proxy and it detected that the traffic matched by application ACL which block file sharing. And the session between my internal clients to cloud proxy is encrypted. Hence why is the firewall able to inspect the encrypted traffic between my internal client and my cloud proxy?

Please advise. TIA!

 

0 Kudos
1 Reply
PhoneBoy
Admin
Admin

It's quite simple: the TLS negotiation happens in the clear.
From that, it's quite easy to see the connection going to drive.google.com.
This wasn't quite as reliable until we added verified SNI support in R80.30 and recent R80.20 jumbos.
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events