R80.20 - SNI vs. enabled HTTPS Interception

[HeikoAnkenbrand]

R80.20+  with enabled HTTPS interception:

If the https interception is enabled, the parameter host from http header can be used for the url because the traffic is analyzed by active streaming. Check Point Active Streaming (CPAS) allow the changing of data, we play the role of “man in the middle”. CPAS breaks the connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.). An application is register to CPAS when a connection start and supply callbacks for event handler and read handler. Several protocols uses CPAS, for example: HTTPS, VoIP (SIP, Skinny/SCCP, H.323, etc.), Security Servers processes, etc. CPAS breaks the HTTPS connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.) 

More read here: R80.x Security Gateway Architecture (Content Inspection) 

R80.20+ without enabled HTTPS interception (SNI is used):

If the https interception is disabled, SNI is used to recognize the virtual URL for application control and url filtering.

More read here: URL Filtering using SNI for HTTPS websites.pdf 

[PhoneBoy]

Hi, just to make a small correction to the above, there are customer-specifix hotfixes for SNI support on R80.10 and R80.20.
Note that with customer-specific fixes you won't necessarily be able to use recent jumbo hotfixes.
R80.30 has this integrated, enabled by default, and we actually verify the SNI requested by the client.
It is by far the better option.

[Til_Hall]

I'm a little bit confused!

Can SNI be used without enabled HTTPS encryption?

[HeikoAnkenbrand · Accepted solution]

Yes! SNI works without enabled HTTPS decryption. If the https interception is disabled, SNI is used to recognize the virtual URL for application control and url filtering.

[PhoneBoy]

Only with JHF117 or above installed.
Otherwise, SNI is NOT used for App Control/URL Filtering.

[Andreas_Mang]

is this on the roadmap for R80.20SP as well? Any target JHF?

[Chris_Atkinson]

R80.20SP JHF Take 191 GA or above.

[Andreas_Mang]

is this on the roadmap for R80.20SP as well? Any target JHF?

[PhoneBoy]

It's planned for the near term, yes, but not familiar with the exact JHF it is planned.