Firsth connection for HTTPS Inspection

[Egor_Cherkasov]

Hello CheckMates,

According to HTTPS Inspection Enhancements in R77.30 and above , every first connection to a site is inspected even if it should have been bypassed according to the policy adn Probe bypass can resolve this issue.

The question is how much time it takes that next connection becomes the first again?

For instance, today I connected to a Financial services web-site and the first connection was inspected by the Check Point certificate, henceforth, next connection during today are not inspected. However, tomorrow the first connection will be inspected again. What are the time frames?

Regards,

Egor.

[PhoneBoy]

My understanding is that it is on the order of a few hours.
Exactly how many hours, I'm not sure.
That said, this might be a good reason to upgrade to R80.30 as we've improved the mechanism a bit in this release.

[Egor_Cherkasov]

Hello,
Thank you anyway.
Could you share the link whereimpoves are described in R80.30?

[abihsot__]

Hi Egor,

In short - just go for R80.30 if you can. Anything else is just not working properly. Especially if you turn on probe bypass. There was a lengthy document somewhere explaining in more detail the issues with skype4b and etc.

[PhoneBoy]

One of our SEs actually recorded a video explaining the enhancements: https://community.checkpoint.com/t5/Access-Control-Products/HTTPS-Inspection-and-website-categorizat...
We also covered it in a previous TechTalk: https://community.checkpoint.com/t5/General-Topics/R80-30-Technical-Update-TechTalk/m-p/55630/highli...