Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Frank_Fausch_sr
Explorer

HTTP Proxy setup - bypass

Hello,

I've setup the Security Gateway as HTTP Proxy in Transparent Mode on all internal Interfaces.

Now I want to set it up that the Clients (coming from Interface 2) do not use Proxy when doing HTTP to Interface 1 (LAN), but to Interface 3 (external). Unfortunatly I don't understand how I could configure this one.
Can i configure this per Interface or is there a Proxy bypass List I can use?
Any help would be appreciated.

Many thanks and best regards

Frank

 

0 Kudos
9 Replies
_Val_
Admin
Admin

You can configure which interfaces on the client side will be proxied by not on the destination side. 

0 Kudos
Frank_Fausch_sr
Explorer

Hello Val,
many thanks for your reply, but exactly this is what is not clear to me.
I want to have it Proxied comming from Client (eth2) to Internet (eth3) but not to LAN (eth1).

Means from eth2 to eth1 it should not be proxyfied.
But from eth2 to eth3 it should be.
So it's both times the Client is on eth2, but the outgoing interface is different.
So which one Interface I have to specify here?

I'm sorry for the stupied question - this is just not clear for me

Many thanks and best regards

Frank

0 Kudos
_Val_
Admin
Admin

This setting is for client side. If you have clients coming from several internal interfaces, you can configure just some of them being proxied. This is not want you are trying to achieve, if I understand correctly. In your case, you want the same clients to be proxied when going to internet, and having direct connections to your DMZ servers. If that is your goal, my answer above stands

0 Kudos
Frank_Fausch_sr
Explorer

Hi Val,
Many thankks for your fast relpy.
So if I understand you corrently, what I'm trying to do (YES --> same clients to be proxied when going to internet, and having direct connections to your DMZ servers) is not possible. Is that correct?

0 Kudos
_Val_
Admin
Admin

not with the transparent proxy, afaik

0 Kudos
Frank_Fausch_sr
Explorer

Would it be possible in explicit Proxy mode?
and if yes, how?

0 Kudos
PhoneBoy
Admin
Admin

Why precisely are you trying to proxy and not just use NAT to achieve what you're after?

0 Kudos
Frank_Fausch_sr
Explorer

we're using NAT for all what is going to Internet, of course.
the Point is, that from CISO point of view we have to proxify traffic going to Internet and not just URL filtering.
That's why I'm trying to find a way to use Proxy if it comes to Client -> Internte Traffic, but not if it comes to Client->LAN traffic.
Trying to do that without external Services like proxy Pac file on another web server.

0 Kudos
PhoneBoy
Admin
Admin

Transparent proxy applies to all web traffic passing through the gateway based on the origin interface.
There is, to my knowledge, no way to configure this based on destination interface.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 
What you're asking for is likely an RFE.

That said, what you're asking for can easily be achieved with NAT.
From a security perspective, I don't see a significant benefit to going with proxy mode (transparent or otherwise).

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Wed 01 May 2024 @ 02:00 PM (EDT)

    South US: HTTPS Inspection Best Practices

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Wed 01 May 2024 @ 02:00 PM (EDT)

    South US: HTTPS Inspection Best Practices

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82
    CheckMates Events