Can we disable the "HTTP protocol parser" or "HTTP inspection engine" for a specific connexion?

[fredlubrano]

Hello all,

My main question concerns the IPS blade: is it possible to disable the HTTP protocol parser or HTTP inspection engine for a custom service?

Here are the details of the issue:

The customer is running R81.20 with the following components:

* Dedicated SmartCenter
* Dedicated SmartEvent
* Several Check Point clusters (Open Server) across multiple sites
* IPS is enabled, and under "Inspection Settings", the option “Non-compliant HTTP” is set to "Inactive". "Fail mode = Fail-Open"
* HTTPS Inspection is "disabled"

We are observing a lot of IPS alerts with the source IP (X.168.46.100) to the same destination (X.168.46.154 and X.168.46.180) over TCP port 50000. After checking with the customer, this traffic (TCP/50000) is SAP related

Log details:

-Forensic reason: “HTTP parsing error detected. Bypassing the request as defined in the Inspection Settings.”
-Precise error: “illegal startline in request”

I found this discussion on the Check Point community:
 [https://community.checkpoint.com/t5/Threat-Prevention/IPS-Connection-accepted-But-why/td-p/136294](h...)
Timothy Hall clearly explains that the specific log is related to an "internal inspection failure", and the system behaved according to the configured policy — in this case, it “failed open (bypass)”.

However, this system error occurs specifically when communication happens between the same source and destinations on TCP/50000.

This leads me to believe that, for some reason, the "HTTP protocol parser" or "HTTP inspection engine" fails to analyze this custom service, triggering a system error.

Therefore, my question is:
We are dealing with a controlled flow (with clearly identified source and destination), would it be possible to disable "HTTP protocol parser" or "HTTP inspection engine" for this connexion? Or alternatively, to create an IPS exception rule? If creating an exception is the recommended approach, what criteria should be used?

I have attached a PDF document containing some configuration details

I hope my explanations are clear!

In advance, thank for your help

Regards

[_Val_]

That would only happen if you have an HTTP handler on a custom service, or "Inspect HTTP on non-standard ports" setting is enabled, see under "Manage & Settings view > Blades > Threat Prevention > Advanced Settings".

[fredlubrano]

Hello Val,

Thank you for your feedback.

I will disable the “Inspect HTTP on non-standard ports” option as you recommended.

However, since this option is global, is there any way to disable it for a specific connection or specific service instead?

Regarding the use of “HTTP Handlers”, I’m not very familiar with them — could you please share some documentation links explaining how to configure or implement them?

Thank you.

Regards

[Timothy_Hall · Accepted solution]

These messages are almost certainly caused by the Inspection Settings, as HTTP parsing is a key part of many of the 146 Inspection Settings Protections.  Under Inspection Settings...Exceptions, try something like this:

You will need two of these for your two destination IP addresses.  It is not well-known that it is possible to disable all Inspection Settings in a single exception, as shown above by specifying "Any" for the Protection and Profile settings.  Reinstall both Access Control and Threat Prevention policies, and start a NEW connection that will match the exception.

If you are still seeing the issue, some of 39 Core Activations may be the cause.  Try disabling them all for this traffic with a Core Activation exception like this:

Reinstall both Access Control and Threat Prevention policies, and start a NEW connection that will match the exception.  If the issue persists, you may need to add a Threat Prevention Global Exception for this traffic under Threat Prevention...Exceptions, but I don't think that will be necessary.

[fredlubrano]

Hello Thimothy,

Thank you for your recommendations.

I’ll implement them by next week.

Regards