Blade HTTPS Inspection Behavior

[GomesLucas]

We have doubts about the behavior of the Blade HTTPS Inspection when there are no rules explicitly created: what happens in the communication? We do not have rules, we understand that the communication will not be inspected, therefore it would be a behavior identical to a bypass.

[Chris_Atkinson]

sk108202 describes the simplified inspection flow.

How is the "fail" mode for the blade configured and what is your objective with having the blade enabled without rules?

@Timothy_Hall has previously posted in detail about the SSL inspection rule order here in case it's helpful for you:

https://community.checkpoint.com/t5/Management/HTTPS-Inspection-Setup/m-p/127750/highlight/true#M278...  

[GomesLucas]

The objective is to understand if there will be bypass or inspect, because even without a rule, it is preventing.

[_Val_]

Correct, without explicit rules, the implied rule is INSPECT

[PhoneBoy]

With no rules in the HTTPS Inspection policy, traffic may get pulled out of fastpath that shouldn't be.
That can cause a performance issue.
There should always be an "any any any bypass" at the end of the HTTPS Inspection policy.

[Timothy_Hall]

A "any any any bypass" rule at the end of the HTTPS Inspection Policy makes sense, but in all the CheckMates presentations the final rule is always "any any 'HTTPS Default Services' bypass".  Which is it supposed to be?

[_Val_]

As shown 🙂 Using ANY service there is a bad idea