Gateway as HTTP/HTTPS Proxy

[Wolfgang]

We have a requirement to use a gateway as HTTP / HTTPS proxy for around 25.000 clients. I'm not really happy in the past with the proxy feature on Check Point appliances and I know the limitation. We are in discussion with the local SEs but I want to ask here and maybe someone has experience wiht the newer releases and the proxy feature.

The gateway should be the proxy for the clients and forward the traffic to internet or another proxy and we want to do some URL-filtering on this traffic.

Any suggestion are welcome.

[Chris_Atkinson]

Sizing is the primary concern since all traffic will be F2F, refer:

sk92482 - Performance impact from enabling HTTP/HTTPS Proxy functionality

[Wolfgang]

@Chris_Atkinson Yes I know. We are running an Maestro environment and it's no problem to add more appliances. This is the real benefit of Maestro. Does Check Point knows such a solution with proxy feature enbled ?

[Chris_Atkinson]

In practice I've personally only seen this done across multiple discrete gateways / clusters using WPAD/PAC or DNS-RR to load-balance.

Possibly something you could replicate with multiple SGs.

Would recommend having your SE engage with Solution Center to arrive at the correct approach.

[Gojira]

It being maestro i would also do an estimation of connection numbers.

As the connection number limit in Maestro i much lower than on the regular gateway.

[Chris_Atkinson]

Whilst true to extent it depends on the exact number & model of gateways (and their memory population) used as to exactly how relevant that is to a given deployment.