Hi all,
I applied a application ACL which blocked all file sharing services on my perimeter firewall which is checkpoint 5600 firewall .
My internal clients uses cloud proxy (which does SSL inspection via man in the middle) to access the internet for web services (http and https).
Curently file sharing service is allowed on my cloud proxy since this is a new deployment and we are in the evaluation stage before applying any restriction or enforcement.
Hence i was suprised why my checkpoint firewall is able to detect and block my internal client access to google drive (via https) since there is no SSL inspection applied on my checkpoint firewall. The destination ip stated in the session tab of the log is the ip of my cloud proxy and it detected that the traffic matched by application ACL which block file sharing. And the session between my internal clients to cloud proxy is encrypted. Hence why is the firewall able to inspect the encrypted traffic between my internal client and my cloud proxy?
Please advise. TIA!
