Clarification on IPS, Anti-Bot, and Anti-Virus Blades Functionality with and without HTTPSInspection

[Saranya_0305]

Dear Team,

I am having a Window Client machine accessing https://abc.com and my checkpoint firewall is default gateway. So in this scenario if I download/upload any malicious file without HTTPS Inspection is my Checkpoint firewall will prevent ?

I have observed that some customers are using the IPS, Anti-Bot, and Anti-Virus blades without enabling HTTPS Inspection. Could you please explain how these blades operate in such a scenario?

Specifically, I would like to understand the following scenarios:

Scenario 1:

HTTPS Inspection - Disabled
IPS, Anti-Bot, and Anti-Virus - Enabled

Scenario 2:

HTTPS Inspection - Enabled
IPS, Anti-Bot, and Anti-Virus - Enabled

Could you kindly explain the operation of these blades in both scenarios and the impact on their performance and detection capabilities?

Thank you for your insights.

@Saranya_0305 

[G_W_Albrecht]

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Conten...

[Chris_Atkinson]

As a basic example some of these blades have protection elements based on either DNS or IP reputation (examples) which don't necessarily require the full decryption of HTTPS traffic, others may also leverage SNI analysis.

Prevention rates are obviously improved for HTTPS traffic scenarios with TLS inspection, this process has performance overheads by comparison however so gateway sizing is important.

Depending upon the role of the gateway enabling HTTPS inspection is recommended for best security, note QUIC inspection is also supported with R82.

[CheckMatesAI]

This answer is provided by Infinity AI Copilot and should be confirmed by reviewing official documentation in Support Center.

Certainly! Let's explore how the IPS, Anti-Bot, and Anti-Virus blades function with and without HTTPS Inspection in the two scenarios you mentioned:

Scenario 1: HTTPS Inspection Disabled, IPS, Anti-Bot, and Anti-Virus Enabled

• Functionality: Without HTTPS Inspection, the Check Point Security Gateway cannot decrypt HTTPS traffic. This means that the IPS, Anti-Bot, and Anti-Virus blades can only inspect the unencrypted parts of the traffic, such as the initial handshake and metadata. They cannot inspect the actual content of the HTTPS traffic.
• Impact on Detection: The detection capabilities are limited because the blades cannot see the encrypted payload. Malicious files or activities hidden within HTTPS traffic may not be detected.
• Performance: Since the traffic is not decrypted, there is less processing overhead, resulting in better performance.

Scenario 2: HTTPS Inspection Enabled, IPS, Anti-Bot, and Anti-Virus Enabled

• Functionality: With HTTPS Inspection enabled, the Security Gateway can decrypt HTTPS traffic, allowing the IPS, Anti-Bot, and Anti-Virus blades to inspect the full content of the traffic. This enables comprehensive threat detection and prevention.
• Impact on Detection: The detection capabilities are significantly enhanced as the blades can analyze the entire content of the traffic, including any malicious files or activities that were previously hidden.
• Performance: Enabling HTTPS Inspection introduces additional load on the Security Gateway's CPU and RAM due to the decryption and re-encryption processes. However, Check Point's R82 release offers improved performance and simplified deployment for HTTPS Inspection, ensuring minimal impact on user experience.

For optimal security, it is recommended to enable HTTPS Inspection to fully leverage the capabilities of the IPS, Anti-Bot, and Anti-Virus blades. You can find more details on HTTPS Inspection best practices in the Check Point documentation.

If you have any further questions or need assistance with configuration, feel free to ask!