Security servers and the rule base chapter 4 security

Security Servers and the Rule Base
Chapter 4 Security Servers and Content Security 221
When
Tunneling
is checked, HTTP requests using the CONNECT method are
matched. The HTTP Security Server does not inspect the content of the request, not
even the URL. Only the host and port number can be checked. Therefore, when
Tunneling
is checked, some Content Security options in the URI Resource
specification, (for example, CVP options, HTML weeding) are disabled.
If you check
Tunneling
, you can still use the URI File or UFP specifications. A URI
File specification must define a file that lists only server names and their port numbers.
The UFP specification must use a UFP server that maintains a list of only server names
and port numbers.
Host
(on the
Match
tab)— Specify the host and port of a known HTTPS server, for
example:
The field to the left of the colon specifies the URI’s host. The field to the right of the
colon specifies the port.
A wildcard character (“*”) indicates any host or any port. For example, you can specify
“*:443” or “*:*”. For HTTPS, “*” (a single wildcard character) is not a valid entry,
though “*” is a valid entry for HTTP or FTP resources.
For more information on URI Resources, see “URI Resources” in Chapter 6,
“Services and Resources”, in the book, Check Point Management Guide .
Non-transparent Mode and HTTPS
To enable the HTTP Security Server to inspect the contents of HTTPS connections,
you can configure the HTTP Security Server to encrypt and decrypt HTTPS
connections. This requires the implementation of Non-transparent Authentication.
This option is known as “Non-transparent Mode” because the user of HTTPS must
access the gateway before being allowed to continue to the target host. Because the
HTTP Security Server is not defined as a Security Proxy to the user’s Web browser,
Non-transparent Mode is best used to authenticate external users accessing internal
servers.
For information on configuring support for HTTPS in Non-transparent Mode, see
“HTTP Security Server and Non-Transparent Authentication” on page 154 in
Chapter 3, “Authentication.”
https server host:443

Security Servers
222 Check Point FireWall-1 • September 2002
Interaction with OPSEC Products
The VPN-1/FireWall-1 Security Servers support third-party products working with
Check Point’s OPSEC SDK. In the OPSEC framework, the enterprise security system
is composed of several components, each of which is provided by a different vendor
and may be installed on a different machine or run simultaneously on the same machine
in different processes. VPN-1/FireWall-1 distributes security tasks to the OPSEC
components. Transactions between VPN-1/FireWall-1 and OPSEC security
components take place using open, industry standard protocols.
Information about OPSEC is available at .