Ssl inspection and quic

[Nima_Chogyal]

I have ssl inspection enabled and workd great for all the apps and urls i wanted to block. But i just can't block Facebook and Instagram. Tried reading about it and found out that Facebook and Instagram have their own way of trusting certificates through their private repo.and that somehow makes it impossible to block them using ssl inspection. But when I block all quic traffic in the network, ssl inspection is somehow blocking them without a hitch. But the only problem I get blocking quic traffic is that I get the Invalid certificate error for Google and all the other websites I surf. And I also learned that blocking quic protocol is the culprit as Google uses quic protocol for their tcp connection. So is there a workaround for this in checkpoint. 

[Chris_Atkinson]

R82 supports inspection of QUIC traffic, are you using an earlier version?

Also if you're seeing cert/trust errors for _all_ sites there is something amiss.

[Nima_Chogyal]

The gateways are r81 but the management server is r82. Thinking of upgrading the gateways to r82 and try it out.

[CaseyB]

Since you are running R81, the guidance has been to block QUIC for HTTPS Inspection to work to its full potential. You mentioned that blocking QUIC causes certificate errors.

Have you verified from the old school SmartDashboard that all of the Trusted CAs are installed / up-to-date? 

[D_TK]

Hi Chris - I saw at a session at CPX this year that basically said R82 supports the inspection of inbound quic (if i was hosting a site over quic to the public), but still does not inspect quic for outbound (my users to the internet with my trusted cert installed). 

Is that correct, or do i have it wrong - thanks.

[PhoneBoy]

You have it wrong, QUIC is supported for outbound.
It does require USFW, though.

[D_TK]

Never been so happy to be wrong.  thanks  will have to test it soon.

[the_rock]

From my cluster lab where I tested this, its backup member, but same on master.

Andy

CoreXL is currently enabled with 6 IPv4 firewall instances.

(1) Change the number of firewall instances
(2) Disable Check Point CoreXL
(3) Change firewall mode

(4) Exit
Enter your choice (1-4) : 3
Firewall is User mode

Important Note: This action might have an effect on GW CoreXL split
Do you want to change to Kernel mode [Requires reboot] (y/n) [n] ? n

(1) Change the number of firewall instances
(2) Disable Check Point CoreXL
(3) Change firewall mode

(4) Exit
Enter your choice (1-4) :

[the_rock]

All I do is add custom group and add *facebook* and *instagram*, install policy, thats it, no need to disable quic, nothing.

Andy

[the_rock]

@Nima_Chogyal Screenshots attached.

Andy