Application Control and URL Filtering

R75.20
Administration Guide

21 August 2011

© 2011 Check Point Software Technologies Ltd. All rights reserved. This product and related documentation are protected by copyright and distributed under licensing restricting their use, copying, distribution, and decompilation. No part of this product or related documentation may be reproduced in any form or by any means without prior written authorization of Check Point. While every precaution has been taken in the preparation of this book, Check Point assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice. RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013 and FAR 52.227-19. TRADEMARKS: Refer to the Copyright page (http://www.checkpoint.com/copyright.html) for a list of our trademarks. Refer to the Third Party copyright notices (http://www.checkpoint.com/3rd_party_copyright.html) for a list of relevant copyrights and third-party licenses.

Important Information
Latest Software
We recommend that you install the most recent software release to stay up-to-date with the latest functional improvements, stability fixes, security enhancements and protection against new and evolving attacks.

Latest Documentation
The latest version of this document is at: http://supportcontent.checkpoint.com/documentation_download?ID=12263 For additional technical information, visit the Check Point Support Center (http://supportcenter.checkpoint.com).

Revision History
Date 21 August 2011 Description Updated the number of categorized URL categories in the Application and URL Filtering Database (on page 23). Improvements made since first release First release of this document

21 July 2011 14 July 2011

Feedback
Check Point is engaged in a continuous effort to improve its documentation. Please help us by sending your comments (mailto:cp_techpub_feedback@checkpoint.com?subject=Feedback on Application Control and URL Filtering R75.20 Administration Guide).

Contents
Important Information .............................................................................................3 Introduction to Application Control and URL Filtering ........................................6 The Need for Application Control ......................................................................... 6 The Need for URL Filtering .................................................................................. 6 The Check Point Solution for Application Control and URL Filtering .................... 7 Main Features ..................................................................................................... 7 Glossary .............................................................................................................. 8 Getting Started ........................................................................................................9 Application Control and URL Filtering Licensing and Contracts ........................... 9 Enabling Application Control on a Gateway ......................................................... 9 Enabling URL Filtering on a Gateway .................................................................10 Creating an Application Control and URL Filtering Policy ...................................10 Creating Rules ...............................................................................................11 Managing Application Control and URL Filtering ...............................................15 The Policy Rule Base .........................................................................................15 Default Rule and Monitor Mode .....................................................................15 Parts of the Rules ..........................................................................................16 UserCheck Interaction Objects ......................................................................20 The Application and URL Filtering Database ......................................................23 Security Category Updates ............................................................................23 Application Categories ...................................................................................23 Application Risk Levels ..................................................................................24 Using the AppWiki .........................................................................................24 Updating the Application and URL Filtering Database....................................24 The Application and URL Filtering Overview Pane .............................................26 My Organization.............................................................................................26 Messages and Action Items ...........................................................................26 Detected in My Organization ..........................................................................26 Top Users ......................................................................................................26 AppWiki ..............................................................................................................26 Gateways Pane ..................................................................................................27 Applications/Sites Pane ......................................................................................27 Creating Applications or Sites ........................................................................27 Creating Categories .......................................................................................28 Creating Application or Site Groups ...............................................................28 Exporting and Importing Applications or Sites ................................................29 Advanced Settings for Application and URL Filtering ..........................................30 HTTP Inspection on Non-Standard Ports .......................................................30 Overriding Categorization ..............................................................................30 HTTPS Inspection ..............................................................................................31 How it Operates .............................................................................................31 Configuring HTTPS Inspection.......................................................................31 HTTPS Inspection in SmartView Tracker .......................................................40 HTTPS Inspection in SmartEvent...................................................................41 Engine Settings ..................................................................................................42 Fail Mode .......................................................................................................42 Check Point Online Web Service ...................................................................42 Connection Unification ...................................................................................43 Web Browsing................................................................................................43 Application Control Backwards Compatibility .................................................44 Application and URL Filtering and Identity Awareness........................................44 Using Identity Awareness in the Application and URL Filtering Rule Base .....44

Identifying Users Behind a Proxy ...................................................................45 Legacy URL Filtering ..........................................................................................46 Terminology ...................................................................................................46 Architecture ...................................................................................................46 Configuring Legacy URL Filtering ..................................................................46 Application Control and URL Filtering in SmartView Tracker ...........................48 Log Sessions ......................................................................................................48 Application Control and URL Filtering Logs ........................................................48 Viewing Logs ......................................................................................................49 Predefined Queries ........................................................................................49 Permissions for Logs .....................................................................................49 Application Control and URL Filtering in SmartEvent........................................51 Event Analysis in SmartEvent or SmartEvent Intro .............................................51 Viewing Information in SmartEvent .....................................................................51 Viewing Information in SmartEvent Intro .............................................................52 The SmartEvent Intro Overview Page ............................................................52 Application Control and URL Filtering Event Queries .....................................52 Setting up a Mirror Port ........................................................................................54 Technical Requirements .....................................................................................54 Configuring a Mirror Port ....................................................................................54 Connecting the Gateway to the Traffic ...........................................................55 Configuring the Interface as a Mirror Port ......................................................55 Checking that it Works ...................................................................................55 Removing the Mirror Port ...............................................................................55 Index ......................................................................................................................57

The use of internet applications comes with problems that administrators must know about:  Malware threats . and YouTube can cause users to download viruses unintentionally. More than ever. employee data is kept private when attempting to determine a site's category. Bandwidth hogging . businesses struggle to keep up with security challenges. can limit the bandwidth that is available for important business applications. for example. Only the host part of the URL is sent to the Check Point Online Web Service.   Employers do not know what employees are doing on the internet and how that really affects them. Popular applications like Twitter. The Need for URL Filtering As with Application Control. Page 6 .Application use can open networks to threats from malware. You can use URL Filtering to:     Control employee internet access to inappropriate and illicit websites Control bandwidth issues Decrease legal liability Improve organizational security When URL Filtering is set.Employees can spend time on social networking and other applications that can seriously decrease business productivity. File sharing can easily cause malware to be downloaded into your network.Chapter 1 Introduction to Application Control and URL Filtering In This Chapter The Need for Application Control The Need for URL Filtering The Check Point Solution for Application Control and URL Filtering Main Features Glossary 6 6 7 7 8 The Need for Application Control The wide adoption of social media and Web 2.0 applications changes the way people use the Internet. access to the internet and non-work-related website browsing can open networks to a variety of security threats and have a negative effect on employee productivity. Facebook.Applications that use a lot of bandwidth. streaming media. Loss of Productivity . This data is also encrypted.

Integrated into Security Gateways . You can easily create policies which detect or block thousands of applications and internet sites. a database with an organization's internal applications that are not necessarily web-based. You can also create an HTTPS policy that enables the gateway to inspect HTTPS traffic to prevent security risks related to the SSL protocol. by individual application. and IAS Appliances.000 Web 2. Categories and Groups You can create applications. It scans for and detects more than 4. Use these custom objects to create a Rule Base that meets your organization's requirements. reporting. for example. or block thousands of applications and internet sites.The Check Point Solution for Application Control and URL Filtering The Check Point Solution for Application Control and URL Filtering Check Point’s latest firewall innovation brings the industry’s strongest URL Filtering. Create a Granular Policy Make rules to allow or block applications or internet sites. Subsequent uncategorized URLs are first checked against the local cache before querying the Check Point Online Web Service. application and identity control to organizations of all sizes. statistics. IP Appliances.     Introduction to Application Control and URL Filtering Page 7 . Only administrators that have been assigned with relevant permissions can see all the fields in a log. Keep Your Policies Updated Application and URL Filtering Database is updated regularly with applications and site categories to help you keep your policy current. or risk levels. websites. Largest application library with AppWiki – Comprehensive application control that uses the industry’s largest application library. Then change the policy to make it even more effective.Use SmartEvent's advanced analysis capabilities to understand your application and site traffic with filtering. Power-1.     Main Features  Granular Application Control – Identify. charts.0 widgets and categories. Custom Applications. and more. The gateway connects to the Check Point Online Web Service to identify social networking widgets and website categories for URLs that it does not recognize. you can easily make rules for individuals or different groups of users. Sites. It is also possible to contact Check Point to create customized application signatures that can be imported into the database. Central Management – Lets you centrally manage security policies for Application Control and URL Filtering from one user-friendly console for easy administration. This provides protection against the increasing threat vectors and malware introduced by internet applications and sites.500 applications and more than 100. This file can contain. SmartEvent Analysis . categories and groups that are not in the Application and URL Filtering Database for use in the policy. When you use Identity Awareness. Use the Application Control and URL Filtering blades to:  Learn about the applications Use Check Point's comprehensive AppWiki to understand what applications are used for and what their risk levels are. Learn What Your Employees are Doing Use SmartView Tracker and SmartEvent to understand the application and site traffic that really occurs in your environment. of all events that pass through enabled Security Gateways. application or URL categories. Using these permissions makes sure that restricted data is kept private in logs and cannot be seen by all administrators.Activate Application Control and URL Filtering on Check Point Security Gateways including UTM-1. allow. Results are stored on a local cache on each Security Gateway.

the rule matches all applications and sites that are marked with that category. Yahoo! Mail. for example Google chat. It does not mean the rate of bytes transferred for a specific unit of time. Sends mail. primary category. Social Network widgets that reside in social networking sites. Programs you use through a browser. In the Application and URL Filtering Database.Glossary Glossary  Applications . Gmail categories include: Supports File Transfer. When URL Filtering is enabled.The searchable applications database. For example. it means the quantity of bytes of traffic. In the AppWiki. for example Microsoft Office. You can include categories in rules in the Rule Base.The category that was matched by the URL Filtering rulebase.     Introduction to Application Control and URL Filtering Page 8 . AppWiki . and others will be blocked. It is available in SmartDashboard and from Check Point's public website.Applications include:      Programs you install on a desktop.Group of applications with a common defining aspect. and additional categories. Bytes . Each application has one primary category which is the most defining aspect of the application. risk level. and Instant Chat.A site which can be accessed via a web browser. categories also define a group of URLs or patterns of URLs.As used in Application Control. Site . additional categories are called tags. for example Farmville on Facebook. applications can have multiple categories. For example if you block the "Sends mail" category: Gmail. For each application it gives: a description. See the category in the application descriptions and in the logs. If a category is in a rule.Characteristics of the application. Primary Category . Additional Categories . Matched Category .

If you do not have a valid contract for a gateway.20 environment. The Gateway Properties window opens. For clusters. New installations and upgraded installations automatically receive a 30 day trial license and updates. make sure you have a contract and license for each cluster member. right-click the gateway object and select Edit.Chapter 2 Getting Started It is easy to get started with Application Control and URL Filtering after you install and configure your R75. Contact your Check Point representative to get full licenses and contracts. Application Control can be enabled on R75 or higher gateways and URL Filtering can be enabled on R75. you will see warnings. When contracts are about to expire or have already expired. Enabling Application Control on a Gateway Enable the Application Control Software Blade on each gateway. In SmartDashboard. Page 9 . In This Chapter Application Control and URL Filtering Licensing and Contracts Enabling Application Control on a Gateway Enabling URL Filtering on a Gateway Creating an Application Control and URL Filtering Policy 9 9 10 10 Application Control and URL Filtering Licensing and Contracts Make sure that each gateway has a Security Gateway license and an Application Control contract and/or URL Filtering contract.20 or higher gateways. the Application Control blade and/or URL Filtering blade is disabled. Warnings show in:   The Message and Action Items section of the Overview pane of the Application and URL Filtering tab. To enable the Application Control Software Blade on a gateway: 1. The Check Point User Center when you log in to your account.

Click OK. you can see logs that relate to application traffic in SmartView Tracker and SmartEvent. select Application Control. Install the policy. After you enable Application Control. The Gateway Properties window opens. make sure it is defined on the Security Gateway or in the management environment. 2. 3. 4.  The Overview pane gives an overview of your policy and traffic. In General Properties > Network Security tab. select URL Filtering. In SmartDashboard right-click the gateway object and select Edit. make sure a DNS has been configured in the environment. Click OK. 4. Getting Started Page 10 . To enable the URL Filtering Software Blade on a gateway: 1. Enabling URL Filtering on a Gateway Before you enable the URL Filtering Software Blade. 3.Enabling URL Filtering on a Gateway 2. These logs show how applications are used in your environment and help you create an effective Rule Base. The policy says who can access which applications and sites from within your organization and what application and site usage is recorded in the logs. In General Properties > Network Security tab. Creating an Application Control and URL Filtering Policy Create and manage the policy for Application Control and URL Filtering in the Application and URL Filtering tab of SmartDashboard. Install the policy. If you have a proxy server in your network.

Source . Click the checkboxes of the items to add to the rule. Applications/Sites .Keep it as Any so that it applies to all traffic from the organization.Click the plus sign to open the Application viewer. Action . Creating Rules Here are examples of how to create different types of rules. The rule allows all Facebook traffic but logs it. Click the Add Rule buttons to get started. Make a rule that includes these components:     Name .Keep it as Allow. 3. You can see the log data in SmartView Tracker and SmartEvent to monitor how people use Facebook in your organization. Getting Started Page 11 .Keep it as All or choose specified gateways to install the rule on.  Look through the AppWiki to learn which applications and categories have high risk levels. In the Available list.Keep it as Log Install On . Add the Facebook application to the rule:  Start to type "face" in the Search field. Destination . The first rule matched is applied. open the Policy page.Creating an Application Control and URL Filtering Policy  The Policy pane contains your Rule Base. Click one of the Add Rule toolbar buttons to add the rule in the position that you choose in the Rule Base. How can I do this? To monitor all Facebook application traffic: 1. Find ideas of applications and categories to include in your policy. which is the primary component of your Application Control and URL Filtering policy. 2.Keep it as Internet so that it applies to all traffic going to the internet or DMZ. Monitoring Applications Scenario: I want to monitor all Facebook traffic in my organization. see the Facebook application.Give the rule a name such as Monitor Facebook traffic. Track .      Click each item to see more details in the description pane. In the Application and URL Filtering tab of SmartDashboard.

You want to block all other Remote Access tools for everyone within your organization.Radmin 2.Creating an Application Control and URL Filtering Policy Blocking Applications Scenario: I want to block YouTube in my organization. You also want to block any other application that can establish remote connections or remote control. also blocks traffic to and from the Captive Portal. The first rule matched is applied. To block all streaming media applications including YouTube. Include these components:     Source . add two new rules to the Rule Base: 1. with the Source and Destination parameters defined as Any. add the Supports Streaming category to the Application/Sites field.Block Getting Started Page 12 .YouTube Action . 2. Make a rule that includes these components:    Applications/Sites .Internet Applications/Sites . 3. Click one of the Add Rule toolbar buttons to add the rule in the position that you choose in the Rule Base. I also want to block other Remote Access applications for everyone. Create a rule below the rule from step 1.Any Destination . All applications that have the Supports Streaming category are blocked. machines.The category: Remote Administration Tool Action . such as YouTube. Important .The Identified_Users access role Destination .Block Track . Using Identity Awareness Features in Rules Scenario: I want to allow a Remote Access application for a specified group of users and block the same application for other users. and network locations as one object. In this example:    You have already created an Access Role that represents all identified users in the organization.Internet Action .A rule that blocks traffic. you can use it together with Application Control to make rules that apply to an access role. You want to allow access to the Radmin Remote Access tool for all identified users. To do this. You can use this to allow access to applications only for users who are identified on the gateway.Log The rule blocks traffic to YouTube and logs attempts to connect to YouTube. Use access role objects to define users. In the Application and URL Filtering tab of SmartDashboard. Create a rule and include these components:    Source . in your organization: 1. How can I do this? If you enable Identity Awareness on a gateway.Allow  Applications/Sites . open the Policy pane. How can I do this? To block an application.

If you use an access role that represents the Technical Support department. Click New > Applications/Sites Group. Blocking Sites Scenario: I want to block sites that are associated with categories that can cause liability issues. and network locations as one object.com/documentation_download?ID=12268).20 Identity Awareness Administration Guide (http://supportcontent. If you enable Identity Awareness on a gateway. you can use it together with URL Filtering to make rules that apply to an access role. then only users from the technical support department are allowed to use Radmin.Creating an Application Control and URL Filtering Policy Notes on these rules:   Because the rule that allows Radmin is above the rule that blocks other Remote Administration tools. see the R75. For more about Access Roles and Identity Awareness. In this example:    You have already created an Access Role that represents all identified users in the organization. You will create a custom group that includes Application and URL Filtering Database categories as well as a previously defined custom site named Smirnoff. In the Application and URL Filtering tab of SmartDashboard. 2. Getting Started Page 13 . machines. Filter by Custom (click the Categories button to clear it and select Custom) and select the custom application. it is matched first. 3. Give the group a name. To create a custom group: 1. For example. 5. 4. Click OK. The Source of the first rule is the Identified Users access role.checkpoint. Use access role objects to define users. How can I do this? You can do this by creating a custom group and adding all applicable categories and the site to it. Liability_Sites. Most of these categories exist in the Application and URL Filtering Database but there is also a custom defined site that must be included. You want to block sites that can cause liability issues for everyone within your organization. open the Applications/Sites pane. Add the group members:   Filter by Categories (make sure only the Categories button is selected) and select the checkboxes of all the related categories in the Application and URL Filtering Database.

Creating an Application Control and URL Filtering Policy The categories and custom site are shown in the group members list. Click OK.Block Blocking URL Categories Scenario: I want to block pornographic sites. and network locations as one object. If you enable Identity Awareness on a gateway. add a rule similar to this:  Create a rule and include these components:     Source . You want to block sites related to pornography. you can use it together with URL Filtering to make rules that apply to an access role. The group is added to the Applications/Sites list.Internet Applications/Sites .Block Getting Started Page 14 . In this example:    You have already created an Access Role that represents all identified users in the organization. 6. How can I do this? You can do this by creating a rule that blocks all sites with pornographic material with the Pornography category.The Identified_Users access role Destination . In the Rule Base.Internet Applications/Sites .Pornography category Action . Use access role objects to define users. add a rule similar to this: Create a rule and include these components:     Source .Liability_Sites Action .The Identified_Users access role Destination . You can now use it in the Rule Base In the Rule Base. machines.

with the tracking set to Log. For example. Default Rule and Monitor Mode When you enable Application Control. But you cannot have an Access Role and an Address Range together in the Source field. For examples of how to create different types of rules. In This Chapter The Policy Rule Base The Application and URL Filtering Database The Application and URL Filtering Overview Pane AppWiki Gateways Pane Applications/Sites Pane Advanced Settings for Application and URL Filtering HTTPS Inspection Engine Settings Application and URL Filtering and Identity Awareness Legacy URL Filtering 15 23 26 26 27 27 30 31 42 44 46 The Policy Rule Base The Application Control and URL Filtering policy determines who can access which applications and sites from an organization. you can also use Access Role objects as the source in a rule. If you enable Identity Awareness on your gateways. The primary component of the policy is the Rule Base. a default rule is added to the Rule Base that allows all traffic from known applications and sites. You cannot use a regular network object and an access role together in one field.Chapter 3 Managing Application Control and URL Filtering You configure Application Control and URL Filtering in SmartDashboard. you can have the source of Rule 4 as an Access Role and the Destination as an Address Range. SmartView Tracker shows the logs and SmartEvent shows real-time traffic statistics and analysis. The rules use the Application and URL Filtering Database. network objects and custom objects (if defined). This lets you easily make rules for individuals or different groups of users. This chapter explains the Application Control and URL Filtering configuration and management that you do in SmartDashboard. Page 15 . see Creating Application Control Rules ("Creating Rules" on page 11). Application and site traffic is allowed unless it is explicitly blocked. There are no implied rules in the Rule Base.

your Application Control policy stays in monitor mode. you can see logs related to application traffic in SmartView Tracker and SmartEvent. Double-click in the Name column of the rule to add or change a name.The Policy Rule Base The result of this rule is that all application traffic is monitored. with the Source and Destination parameters defined as Any. But if you do not change the default rule. for example:   You change the tracking to none You change the value in Applications/Sites from Any Recognized to a specified application. The source can be an Access Role object. Therefore. The name can include spaces.) The sequence of rules is important because the first rule that matches an application is applied. Then no traffic will be monitored. also blocks traffic to and from the Captive Portal. The default is Any. If you change the default rule. If rule 3 allows Gmail and rule 4 blocks applications with the Instant Chat additional category.A rule that blocks traffic. If you do not add other rules to the Rule Base. Parts of the Rules The columns of a rule define the traffic that it matches and what is done to that traffic: Number (NO. you will also see names of identified users in the logs. Transmits Personal or Enterprise Information. Managing Application Control and URL Filtering Page 16 . You can add more rules that block specified applications or sites or have different tracking settings. For example. which you can define when Identity Awareness is enabled. traffic that is not included in other rules is allowed and monitored. Important . Gmail will be allowed based on rule 3. Put your mouse in the column and a plus sign shows. If you enabled Identity Awareness on the gateway. This means that you see application traffic in the logs but do not block access to applications. Gmail's additional categories include Sends Mail. Use the data there to better understand the use of applications in your environment and create an effective Rule Base. Name Give the rule a descriptive name. Source The source is where the traffic originates. and Instant Chat. Click the plus sign to open the list of network objects and select one or multiple sources.

Activate Web Browsing in Advanced > Engine Settings. click the buttons in the toolbar of the viewer. To choose other destinations. Custom defined items are set in SmartDashboard by the administrator and are not a part of the Application and URL Filtering Database. Because Web Browsing traffic can generate a lot of logs. click the name of the Available item. For each application or widget. the viewer shows a description and if there are applications or sites related with it. select the level from the Risk field in the toolbar. For example. One rule can include multiple items and items of different types. To see all applications in a risk level. sites. the Web browsing application has its own activation setting. You can select an application. applications. The Available list shows the filtered items and then you can add items to the rule. The default is the Internet.   Managing Application Control and URL Filtering Page 17 . Click the plus sign to open the list of network objects and select one or multiple destinations. If you delete the destination value. category. Applications/Sites The Applications/Sites column contains the applications and categories for sites and applications that you choose to include. If you do not enable URL Filtering on the Security Gateway. one rule can include 2 applications and 3 categories. Click the plus sign to open the Application viewer. The results show in the Available list. To add applications or categories to a rule: Put your mouse in the column and a plus sign shows. categories and groups. put your mouse in the column and a plus sign shows. To filter the Available list by categories. custom-defined items or widgets. with the Source and Destination parameters defined as Any. there is also an application called Web Browsing. The default is that the rule applies to all known applications and sites. the rule changes to Any. You can also include widgets and custom defined applications. also blocks traffic to and from the Captive Portal. site or group to add to the rule from the Available list. the viewer shows a short description and its related categories. The category on which the rule is matched is shown in the SmartView Tracker logs in the Matched Category field.     To add an item to the rule. To see the details of an item without adding it to the rule. For each category. If you know the name of an application or category. which applies to traffic going to all destinations Important .The Policy Rule Base Destination Choose the destination for the traffic. you can search for it. click the checkbox in the Available list. which includes all traffic with the destination of DMZ or external.A rule that blocks traffic. The Web Browsing application includes all HTTP traffic that is not a defined application.

Configure how often the user should see the configured message when the action is ask. or block. application or site. Action Action refers to what is done to the traffic. If no UserCheck object is defined for this action. Blocks the traffic. or application or site group. or a reason box. Once the authentication credentials are obtained.The Policy Rule Base  To add a new category. Click in the column to see the options and select an action to add to the rule. further connections from this source are inspected without requiring authentication. Managing Application Control and URL Filtering Page 18 . User Check Frequency Edit User Check Opens the User Check message for editing Message Captive Portal Redirects http traffic to an authentication (captive) portal. no page is displayed. Action Allow Inform Ask Block Meaning Allows the traffic Sends a message to the user attempting to access the application Asks the user a question and adds a confirmatory check box. use the New button. inform.

The alerts are defined by the scripts specified in Policy > Global Properties > Log and Alert > Alert Commands. For more about logs.Opens SmartEvent and shows logs related to the rule. View rule logs in SmartEvent . Select All Rules . Using this option can have an effect on performance. Extended Log .Consolidates logs by session. User Defined Alert . It consolidates logs by session (there is one log for each session).Deletes the selected rule or rules. or run a user-defined script as defined in Policy > Global Properties > Log and Alert > Alert Commands. Alert . Note . click the icons to create new rules or to delete the selected rules.Sends an email to the administrator. such as display a popup window. Track Choose if the traffic is logged in SmartView Tracker or if it triggers other notifications.A rule that blocks traffic. a menu opens with these options:       New Rule . Complete Log .Does not record the event Logs:  Log . shows the number of suppressed logs and includes data for each URL request in the session time frame. It shows the initial URL browsed and the number of suppressed logs it includes.Opens SmartView Tracker and shows logs related to the rule.Sends one of three possible customized alerts. The options include:   None .Sends a SNMP alert to the SNMP GUI. Disable Rule .Records the event in SmartView Tracker with byte information. Note that this option generates many logs.Select to create a new rule Above or Below the rule that is currently selected.      Managing Application Control and URL Filtering Page 19 .   Account . also blocks traffic to and from the Captive Portal.Records logs for each URL request made regardless of session.Logs the event and runs a command. This option also generates an event in SmartEvent for each URL browsed and is intended only for troubleshooting purposes. see log sessions (on page 48). or runs the script defined in Policy > Global Properties > Log and Alert > Alert Commands. with the Source and Destination parameters defined as Any. Delete Rule .The Policy Rule Base Action Rule Actions Meaning From the toolbar at the top of the Application Control Policy page. SNMP Trap . Important .The rule stays in the Rule Base but is not active.Selects all the rules and you can then choose another action to apply to them.The actions Block. Each of the URLs has an entry in the URLs tab of the log in SmartView Tracker. send an email alert or an SNMP trap alert. This option is useful to get general information on your network's traffic. View rule logs in SmartView Tracker . Each URL request has its own log.Records the event's details in SmartView Tracker. Click in the column and the options open. and Inform involve the creation of UserCheck Interaction Objects (on page 20). Ask. If you right-click in a column of the Rule Base and select Rule Actions. Mail . or runs the mail alert script defined in Policy > Global Properties > Log and Alert > Alert Commands.

Switching to HTML mode closes the formatting toolbar. Insert field variables for:  Application name  Category  Username  Original URL  Source IP  Incident ID Variables are replaced with applicable values when the (Block.Active Directory logs are used to map the IP address of the computer to a user name Managing Application Control and URL Filtering Page 20 .The Policy Rule Base Install On Choose which gateways the rule will be installed on. UserCheck Interaction Objects UserCheck Interaction Objects add flexibility to Application Control by giving the Security Gateway a mechanism for communicating with users. alignment. make sure to set the Voyager management application port to a port other than 443 or 80. If a UserCheck object is set as the action on a policy rule. the user's browser redirects to the SecurePlatform Administration web Portal on port 443 or 80. Enter a name for the UserCheck object and a comment. enter the message content. or: New UserCheck. In the second text box. 3. add or remove bullets. select one of these interaction modes:   2. Click the text box adjacent to the picture and enter title text for the message. 6. Note . The UserCheck Interaction window opens on the Message page. such as company logo. 4. Click the picture box to add a graphic.Right-clicking inside any of the text boxes gives you the option to Switch to HTML mode and enter HTML code directly. Note . Put your mouse in the column and a plus sign shows. The Identity Awareness blade obtains the user's identity through:  AD query . Inform Ask  Block Select one of the existing UserCheck Interaction objects. UserCheck objects are actions in the Application & URL Filtering rule base that:   Help end users with decisions that can have an adverse effect on the organization's security. Select a language (English is the default) from the language tabs. 7. The portal hosts UserCheck notifications.When you enable UserCheck on a Security Gateway that is on an IP Series appliance. Share the organization's changing internet policy for web applications and sites with end users in real time.The graphic must have a height and width of 70x70 pixels. The default is All.   Use the formatting toolbar to change text color. In the Application & URL Filtering > Policy rule base > Action column. which means all gateways that have Application Control enabled. Creating UserCheck Interaction Objects 1. Ask. 5. Click the plus sign to open the list of available gateways and select. 8. Note . Inform) action occurs and the message shows.

These hostnames must be resolved to 143. 3. The Application & URL filtering tab > Gateways window shows a list of Security Gateways with the Application Control blade enabled. Use the Insert a User Input variable to add a:  Confirm checkbox  Textual Input  Wrong report category Click Preview in browser to see the results in your default browser. Identity Agent . Managing Application Control and URL Filtering Page 21 . Select a gateway and click Edit.mycompany. select an alternative Action (allow or block) for when the UserCheck notification cannot be displayed. Install policy. Clicking OK creates the UserCheck object and web page notification for the portal. Click OK. To Configure a Security Gateway for UserCheck: 1.Users are redirected to the Captive Portal.74.Software running on the endpoint computer that identifies the user to the Security Gateway.The Policy Rule Base    Captive Portal . 10. Configure the UserCheck page. 2. 12. for example: Usercheck. The portal redirects the user to the specified URL. The UserCheck page contains these options: Option New Edit Delete Clone Regular View Mobile Device Meaning Creates a new UserCheck object Modifies an existing UserCheck object Deletes an UserCheck object Clones the selected UserCheck object. The Properties window on the gateway opens. 4. Optimizes the message for display in a Web Browser Optimizes the message for display in a Mobile Device Configuring the Security Gateway for UserCheck UserCheck is enabled or disabled directly on the Security Gateway. 9. NOTE:   We recommend pointing the Main URL to internal gateway interfaces. On the Fallback Action page. the Accessibility option must be set to one of these:   Aliases Through all interfaces According to the firewall policy Click Aliases to add URL aliases that redirect additional hostnames to the main URL. UserCheck objects can be created and customized on the Application & URL Filtering tab > UserCheck page. Click OK. and need to identify themselves. The external system obtains authentication credentials from the user. such as a user name or password.100. But: If the Main URL points to an external interface. 11.com.1 on the corporate DNS server. The specified URL can be an external system. Option Main URL Function The primary URL for UserCheck notifications. On the Redirect to External Portal page you can configure an URL to which the user is redirected.

clear hits of specific user uci. the portal uses a certificate from the Check Point Internal Certificate Authority (ICA). To avoid these warnings. This is useful if you change an existing notification. User hits listing options          all. Click Edit to configure interfaces on the gateway through which the portal is accessible. These options are based on the topology configured for the gateway. The usrchk command can be used to clear the history of the usercheck object. User hits clearing options db. list all existing hits user. Select this option if there is a rule that states who can access the portal. clear all existing hits user. user hits database options Managing Application Control and URL Filtering Page 22 . This might generate warnings if the user's browser does not recognize Check Point as a trusted Certificate Authority. and want the message to start showing again as if for the first time.The Security Gateway has an internal persistence mechanism that preserves UserCheck notification data if the gateway or gateway cluster reboots. list hits of specific user uci. list hits of specific user check interaction object name all.The Policy Rule Base Option Certificate Function By default. Records of a user answering or receiving notifications are never lost. Accessibility  Disable UserCheck Turns UserCheck on or off Note . UserCheck on the Command Line A UserCheck command is available on the gateway command prompt. Users are sent to the UserCheck portal if they connect:   Through all interfaces Through internal interfaces (default)  Including undefined internal interfaces  Including DMZ internal interfaces According to the Firewall policy. import your own certificate from a recognized external authority. clear hits of specific user check interaction object name clear. Description Syntax Parameters usrchk usrchk [debug] [hits] Parameter debug hits Description Controls debug messages shows user hit options:  list.

click the plus sign in the Application column. Sends mail. You can include applications and categories in your Application Control and URL Filtering rules. For URL Filtering: Goes to the local cache to see if the data is already there.000 social networking widgets and about 96 million categorized URL categories. categories and social networking widgets. Each item has a description. Open it from the AppWiki pane in the Application and URL Filtering tab or from the Check Point website (http://appwiki.htm). botnet. For security related categories. each application is assigned to one primary category based on its most defining aspect. For Application Control: Matches locally stored signatures.500 applications. such as phishing. If an additional category is in a rule. The local cache is updated on a regular basis depending on the category involved. For URL Filtering. 2. When the cache does not have an answer.com/appwiki/applications. malware.From the Application Control Rule Base in SmartDashboard. the database is updated regularly with new applications. Access the Application and URL Filtering Database from:  SmartDashboard . you can filter by additional category or risk level to see all applications with that characteristic. Application Categories In the Application and URL Filtering Database. some of the additional categories of Gmail include: Supports File Transfer. Upon rule match in the Rule Base.checkpoint. A local cache on each Security Gateway has been designed to give answers to 99% of all URL categorization requests. If the category data is not in the cache. See the category in the description of each application and in the logs. more than 100. In that time frame. additional categories. it is possible that the initial categorization of a security category is updated on the Check Point Online Web Service. a URL categorized as portal. This lets you easily create and maintain an up to date policy. which are characteristics of the application.In the AppWiki. This maintains user privacy since no user parameters are sent for the categorization procedure. AppWiki . each Security Gateway also has:   A local database that contains commonly used URLs and their related categorization.An easy to use tool to see the Application and URL Filtering Database. additional categories are called tags. each application can have additional categories. For example.  Security Category Updates The local cache on each Security Gateway keeps URL categorization responses up to 3 days. and Instant Chat. For example. it is necessary to determine if the URL is an application and its related category. is updated to phishing after 24 hours.The Application and URL Filtering Database The Application and URL Filtering Database The Check Point Application and URL Filtering Database contains more than 4. From there you can add applications and categories directly into the Rule Base. Managing Application Control and URL Filtering Page 23 . When you have a valid Application Control and/or URL Filtering contract. the Security Gateway accesses the Check Point Online Web Service. and spam) are updated in a security service list by the Check Point Online Web Service. For Application Control and URL Filtering: If the URL is suspected to be a widget or the category data is not in the cache. and a risk level. Changes made to URLs with security categories (such as phishing. This is a good way to get ideas of types of applications that you might want to block or allow. only the host name is sent to the Check Point Online Web Service for categorization. and the Application viewer opens. it checks the local database for the URL category. In the Application and URL Filtering Database. there is a special update policy that allows fast updates to occur. To do this the Security Gateway does these steps: 1. the rule matches all applications that are marked with it. a category. Note . When you use the AppWiki or add applications to the Rule Base.

Google Finance You can filter a search based on the risk level. the rule is updated automatically when the database is updated. File Sharing. This table explains what each level means and gives examples of applications or types of applications with that level. click Update Management to update the management only. YouTube.Low 1. This helps you to understand which types of applications to be wary of and which are low risk. Search for a word or application. Using the AppWiki The AppWiki is an easy to use tool that lets you search and filter the Application and URL Filtering Database to find out information.    Learn about applications. By default. Before you run the scheduled update. To manually update the management server only:  On the Advanced > Updates pane of the Application and URL Filtering tab. For example. WebEx.The Application and URL Filtering Database If new applications are added to an additional category that is in an Application Control or URL Filtering rule.checkpoint.High Definition Can bypass security or hide identities Can cause data leakage or malware infection without user knowledge Can be misused and cause data leakage or malware infection Potentially not business related. The risk level is also a tag that shows in the details of each application. Media 3 . Access the AppWiki from the Application and URL Filtering tab or from the Check Point website (http://appwiki. tag. all new Application Control installations have a valid contract for 30 days.Medium 2. but low risk Examples Tor. Gmail Gaming. The Application and URL Filtering Database only updates if you have a valid Application Control and/or URL Filtering contract.htm). Application Risk Levels The Application and URL Filtering Database and AppWiki show a Risk Level for each application. File Storage (Drop box).Very Low Usually business related with no or very low risk SalesForce. in the Automatic Application Updates section of the Updates pane. select risk level 5 to see all applications with that risk level.com/appwiki/applications. Facebook. By default. P2P (uTorrent.Critical 4 . select both:   Update Application and URL Filtering Database on the Security Management Server Update Application and URL Filtering Database on the Security Gateway Managing Application Control and URL Filtering Page 24 . The updates are stored in a few files on each Security Gateway. Kazaa) Instant messaging. To change the schedule for updates on the management server and gateways: 1. including social networking widgets. You can change the update schedule or choose to manually update the management server. Risk Level 5 . VTunnel Remote Desktop. Filter by a category. Updating the Application and URL Filtering Database The Application and URL Filtering Database automatically updates regularly to make sure that you have the most current data and newly added applications and websites in your Application Control and URL Filtering policy. or risk level. updates run on the Security Management Server and gateways every two hours.

Click OK. a scheduled update runs at two hour intervals. configure a proxy in Policy > Global Properties > Proxy. Click Configure Proxy to go to the SmartDashboard page to configure the proxy for the Security Management Server. click Configure to schedule when the updates will run. Select the days when the update will occur. if necessary. If you only update the gateways. you will see in SmartDashboard that the gateway has a new version of the Application and URL Filtering Database. If you have Security Gateways in different time zones. they will not be synchronized when one updates and the other did not update yet. click Configure. On the Advanced > Updates pane. To configure a proxy: The Advanced > Updates pane shows if the Security Management Server uses a proxy to connect to the internet or not. Select At to set days of the week or month and a time of day for updates to occur:  Enter an hour in the format that is shown. To make sure that it can get the updates successfully:    Make sure that there is a DNS server configured. Make sure a proxy is configured for each gateway and the Security Management Server. set the Time of Event. The Scheduled Event Properties window opens. you can see relevant database changes in SmartDashboard. go to Topology > Proxy. In a Multi-Domain Security Management environment. Managing Application Control and URL Filtering Page 25 . In the General page. in the Scheduled Updates section. By default.  Click Days and the Days page opens. In Multi-Domain Security Management.   Select Every and adjust the setting to run the update after an interval of time.The Application and URL Filtering Database When you update the database on the Security Management Server. In SmartDashboard. 2. Connecting to the Internet for Updates The gateway or Security Management Server connects to the internet to get the Application and URL Filtering Database updates. 2. under Schedule Updates. If you select Days of week or Days of month. On the Updates pane. more options open for you to select. 3.   Scheduling Updates To change the update schedule from the default scheduled Application and URL Filtering Database updates: 1. update the database for all Domain Management Servers in the Global SmartDashboard and not from Domain Management Servers. in the object properties of a gateway or Security Management Server.

Top Users Shows a graphical summary of the most popular users who use applications the most. Click the arrows to browse through the types of Social Networking Widgets.Link to open SmartEvent where you can see the traffic statistics and analysis. Select the criteria for the graph data: Bandwidth or Sessions. The gateway connects to the internet to get the most current AppWiki. My Organization   Shows a summary of which Security Gateways enforce Application Control and URL Filtering.Link to open the Application Control and URL Filtering logs in SmartView Tracker.Link to open the Application Control and URL Filtering logs in SmartView Tracker. Click the links to go directly to the AppWiki. Make sure that there is a DNS server configured. . Detected in My Organization Shows a graphical summary of the most popular applications in Top Applications. It also has a link to the Gateways pane.     Select a time interval for graph data. Click the link to see them. Managing Application Control and URL Filtering Page 26 . Shows if Security Gateways require renewed licenses or Application Control or URL Filtering contracts.     Select a time interval for graphs data. Use the windows for the most urgent or commonly-used management actions. AppWiki     Shows current statistics of the quantities and types of Applications and Social Networking Widgets included in the Application and URL Filtering Database. Messages and Action Items   Shows if a new Application and URL Filtering Database update package is available. The number of Block rules.Link to open SmartEvent where you can see the traffic statistics and analysis. Shows the total number of rules in the policy:   The number of Allow rules. Select the criteria for the graph data: Bandwidth or Sessions. Click the link to see them. you can quickly see the status of computers and incidents. the most popular categories in Top Categories and the most popular sites in Top Sites. . . .The Application and URL Filtering Overview Pane The Application and URL Filtering Overview Pane In the Application and URL Filtering Overview pane.

The Application/Site wizard opens. you see the name and type and also:   Primary Category . Description . Managing Application Control and URL Filtering Page 27 . Select one of the options:  Applications/Sites URLs . 5. Click Next. you see the gateway name and IP address. click the Applications/Site object in the list and click Edit. click URLs are defined with regular expressions. Select a gateway and click Edit to edit the gateway properties.  Applications/Sites URLs from a file (. Identity Awareness . In the Application and URL Filtering Database Updates section. you can also see the status of the Application and URL Filtering Database on the Security Management Server. categories and groups you defined. You can import a customized application binary file that Check Point prepares for applications not in the Application and URL Filtering Database. Creating Applications or Sites You can create a custom application or site to use in the Rule Base. search. You also see these columns:      Application Control . b) If you used a regular expression in the URL. If you selected Applications/Sites URLs: a) Enter a URL and click Add.To upload a .If the object is an application or website.If Identity Awareness is enabled. Applications/Sites Pane The Applications/Sites pane lists the custom applications. 4. the URLs are imported when you click Finish.csv (comma separated values) file to add many URLs at one time from an external source. When you use the . a summary of its Identity Awareness status. This file can contain for example a database with an organization's internal applications that are not necessarily web-based. Click Updates to go to the Updates pane. Enter a name for the application/site. To create an application or site: 1.If URL Filtering is enabled.Gateways Pane  Make sure a proxy is configured for each gateway and the Security Management Server. Gateways Pane The Gateways pane lists the gateways with Application Control and/or URL Filtering enabled. this column shows the primary category assigned to it. In the Applications/Sites pane. For each gateway. sites. import and export objects.To manually enter a URL. You can use the toolbar buttons to create. Select an object in the list and click Edit to edit the object's properties.csv) .The comment entered for the custom-defined object.All relevant comments. 3. You can enter the URLs manually or use a .If the Application and URL Filtering Database is up to date on the gateway or if an update is necessary. 2. A message shows if the Management server is up to date or if a new update is available. For each object in the list. delete. If it is necessary to edit the URLs. URL Filtering .csv file syntax is one URL for each line in the text file. if necessary. Update Status . Comments .csv file option.If Application Control is enabled. The .csv file with URLs. and if so. click New > Application/Site.

To create an application or site group: 1. Managing Application Control and URL Filtering Page 28 . widgets. Note . You can use this group in the policy. you can override the categorization ("Overriding Categorization" on page 30). 3. 4. click New > Category. Click Add. c) Click OK. 2.csv): a) Browse to the .You can click New in the list to create a new category. 7. The Application viewer opens. Enter a comment for the group (optional). The Category Properties window opens. 5. 5. 8. 7. Select a Primary Category for the application or site. 9. b) Click Next. sites and categories. Enter a name for the category. You can use this custom application or site in the policy. The selected items are shown in the Group members list. To select Additional Categories: a) Click Add.Applications/Sites Pane c) Click Next and go to step 7. Creating Categories You can create a custom category to use in the Rule Base if there is no corresponding category. To create a new category: 1. Enter a description for the category (optional).csv file and upload it. 4. In the Applications/Sites pane. The Applications/Sites group window opens. Creating Application or Site Groups You can create a group of applications or sites to use in the Rule Base. 3. Click OK.If category data in the Application and URL Filtering Database for a URL is not applicable for your organization. 8. Click Next. You can use this custom category object in the policy. and custom items to add as members ("Applications/Sites" on page 17) to the group. 10. Set a color for the category icon (optional). Click Finish. applications and widgets from the Application and URL Filtering Database and also custom applications. Click OK. b) Select the necessary checkboxes in the list. 6. Select the categories. Enter a name for the group. click New > Applications/Sites Group. 6. The group members can include categories. Note . applications. In the Applications/Sites pane. Click OK. If you selected Application/Sites URLs from a file (. 2. Set a color for the group icon (optional).

select Actions > Import.apps. Select the location that the object will be exported to and click OK. From the Applications/Sites pane. To import an application or site file: 1. The custom applications have an . 3. From the Applications/Sites pane. Click OK. After importing the file. The Custom Application object is added to the Applications/Sites list.apps file. select it and click Open. The Browse for Folder window opens. The Import Applications/Sites window opens. select Actions > Export.apps suffix.Applications/Sites Pane Exporting and Importing Applications or Sites You can export and import Check Point custom applications for Application Control from the Applications/Sites pane. To export an existing object: 1. you can include them in your Rule Base. Managing Application Control and URL Filtering Page 29 . Browse to the location of the . You can import exported objects into a SmartDashboard of the same version. proprietary applications). These are signatures that Check Point creates for organizations that have network applications not in the Application and URL Filtering Database (for example. The object is exported to that location with the file name <object_name>. 2. 2.

click Add. select New. You can use the toolbar buttons to create. These settings apply globally for all gateways with Application Control and URL Filtering. 7. In the Advanced > Override Categorization pane.Advanced Settings for Application and URL Filtering Advanced Settings for Application and URL Filtering This section describes settings that you can configure in the Application and URL Filtering tab. The Override Categorization for URL window opens. To add additional categories. The URL with its newly defined categories is shown in the list in the Override Categorization pane. 8. Managing Application Control and URL Filtering Page 30 . Select a Risk from the list. You can configure this option in the Advanced section of the Application and URL Filtering tab. The selected categories are shown in the Additional Categories list. the category data in the Application and URL Filtering Database for a URL is not applicable for your organization. To override categorization for a URL: 1. 3. edit. Click OK. Some applications send HTTP traffic on other ports also. or to also inspect HTTP traffic on non-standard ports. You can also configure IPS to inspect HTTP traffic on non-standard ports. search. This option is selected by default. Enter a URL in the field. The Rule Base will use the newly specified categorization when matching rules with URLs. 6. Select the categories and click OK. Overriding Categorization In some cases. 9. HTTP Inspection on Non-Standard Ports Applications that use HTTP normally send the HTTP traffic on TCP port 80. If the URL contains a regular expression. Enter a comment (optional). When selected. even if it is sent using nonstandard ports. and delete a categorization entry. You can use the override categorization option to update the category and risk definitions of a URL. select URL is defined as a Regular Expression. 5. 2. Select a Primary Category from the list. You can configure some Software Blades to only inspect HTTP traffic on port 80. You do not need to include the prefix http:\\. the Application and URL Filtering policy inspects all HTTP traffic. This definition overrides the information in the Application and URL Filtering Database and the responses received from the Check Point Online Web Service. 4. in the Advanced section of the navigation tree.

the Security Gateway: 1. All data is kept private in HTTPS Inspection logs.   Managing Application Control and URL Filtering Page 31 . This lets the client computers trust all certificates signed by this certificate. The Security Gateway acts as an intermediary between the client computer and the secure web site. Establishes a secure connection (an SSL tunnel) to the requested web site and validates the site's server certificate. The SSL protocol is widely implemented in public resources that include: banking. Only administrators with HTTPS Inspection permissions can see all the fields in a log. Generate an HTTPS inspection policy by defining relevant rules in the HTTPS inspection Rule Base. and corporate web resources. SSL secures communication between internet browser clients and web servers. Using the two tunnels: a) It decrypts the encrypted data from the client. Intercepts the request. 4. you must deploy it in the Trusted Root Certification Authorities Certificate Store on the client computers. Without these permissions. web mail. Security Gateways without HTTPS Inspection are unaware of the content passed through the SSL encrypted tunnel. Encrypted data sent by a client to a web server is:    Intercepted by the Security Gateway and decrypted. This is controlled by administrator permissions.HTTPS Inspection HTTPS Inspection You can enable HTTPS traffic inspection on Security Gateways to prevent security risks related to the Secure Sockets Layer (SSL) protocol. Create a generated CA on the Security Management Server or import a CA certificate already deployed in your organization. Creates a new SSL certificate for the communication between the Security Gateway and the client. 2. Security Gateways must examine the data as clear text. One example of a threat is when an employee uses HTTPS (SSL based) to connect from the corporate network to internet web servers. some data is hidden. c) Encrypts the data again to keep client privacy as the data travels to the destination web server resource. Encrypted again and sent to the designated web server. The Security Gateway behaves as the client with the server and as the server with the client using certificates. sends the client the new certificate and establishes a different SSL tunnel with it. If you created a CA certificate. Inspected by the blades set in the policy. b) Inspects the clear text content for all blades set in the policy. However. SSL has a potential security gap. you must do these steps:    Set the Security Gateway for HTTPS Inspection. This makes the company vulnerable to security attacks and sensitive data leakage. It can hide illegal user activity and malicious traffic from the content inspection of Security Gateways. user forums. It also supplies data privacy and integrity by encrypting the traffic. Update the trusted CA list in the Security Gateway (if necessary). How it Operates When a client computer initiates an HTTPS connection to a secure site. For HTTPS traffic inspection. 3. Configuring HTTPS Inspection To enable HTTPS traffic inspection. based on standard encryption ciphers.

make sure the initial certificate was exported ("Exporting a Certificate from the Security Management Server" on page 33) from the Security Management Server on which it was created. This password is only used when you import the certificate to a new Security Management Server. To import a CA certificate: 1. Importing a CA Certificate You can import a CA certificate that is already deployed in your organization or import a CA certificate created on one Security Management Server to use on another Security Management Server. The gateways use this password to sign certificates for the sites accessed. 4. In SmartDashboard.Enter the password that is used to encrypt the private key of the CA certificate. Click OK. click Create. make sure to export the certificate and deploy it ("Exporting and Deploying the Generated CA" on page 33) on the client machines.HTTPS Inspection  Configure the conditions for dropping traffic from a web site server.Enter the domain name of your organization. Private key password . 2. 3. Creating a CA Certificate The CA certificate is saved with a P12 file extension and uses a password to encrypt the private key of the file.  Valid from . you must:   Import the CA certificate. 5. right-click a gateway object. Important .If you are importing a CA certificate created on another Security Management Server. Retype private key password . select HTTPS Inspection. right-click the gateway object and select Edit. You can configure a troubleshooting option that logs such connections ("Troubleshooting" on page 40).Select the date range for which the CA certificate is valid. The Gateway Properties window opens. Enabling HTTPS Inspection on a Gateway You must enable HTTPS inspection on each gateway. In the navigation tree. users will receive SSL error messages in their browsers when connecting to HTTPS sites. To create a CA certificate: 1. select Edit > HTTPS Inspection > Import Managing Application Control and URL Filtering Page 32 . For each Security Management Server that has Security Gateways enabled with HTTPS inspection. you must create a CA certificate for HTTPS inspection or import a CA certificate already deployed in your organization. Enter the password the Security Management Server uses to decrypt the CA certificate file and sign the certificates for users. you must export it so it can be distributed to clients. This certificate is used by all gateways managed on the Security Management Server. In the HTTPS Inspection page. Export and deploy the CA certificate ("Exporting and Deploying the Generated CA" on page 33). Important . After you create a CA certificate.Retype the password.After you import a certificate from another Security Management Server. In SmartDashboard. You must keep the password as it also used by other Security Management Servers that import the CA certificate to decrypt the file. Enter the necessary information:    Issued by (DN) . 6. If you do not deploy the generated CA certificate on clients. The first time you enable HTTPS inspection on one of the gateways.

install the generated CA certificate used by HTTPS inspection as a trusted CA.HTTPS Inspection Or From the HTTPS Inspection > Gateways pane of a supported blade. A GPO can contain multiple configuration options.Make sure that the CA certificate is pushed to the client machines' organizational unit. You can distribute the CA with different distribution mechanisms such as Windows GPO. 3. When users do standard updates. The Import Certificate window opens. click Export certificate Or From the HTTPS Inspection > Gateways pane in a supported blade. Note . the generated CA will be in the CA list and they will not receive browser certificate warnings. From the HTTPS Inspection window of the Security Gateway. click Export. 2. and is applied to all computers that are within the scope of the GPO. To distribute a certificate with a GPO: 1. Usage: export_https_cert [-local] | [-s server] [-f certificate file name under FWDIR/tmp][-help] To export the CA certificate:  On the Security Management Server. 4. 5. 3. click the arrow next to Create Certificate and select Import certificate from file. run: $/FWDIR/bin/export_https_cert -local -f [certificate file name under FWDIR/tmp] For example: $/FWDIR/bin/export_https_cert -local -f mycompany.p12 Exporting and Deploying the Generated CA To prevent users from getting warnings about the generated CA certificates that HTTPS inspection uses. Membership in the local Administrators group. 4. Browse to the certificate file. Deploying Certificates by Using Group Policy You can use this procedure to deploy a certificate to multiple client machines by using Active Directory Domain Services and a Group Policy object (GPO). Exporting a Certificate from the Security Management Server If you use more than one Security Management Server in your organization. you must first export the CA certificate using the export_https_cert CLI command from the Security Management Server on which it was created before you can import it to other Security Management Servers. Open the Group Policy Management Console. Enter the private key password. Test the distribution by browsing to an HTTPS site from one of the clients and verifying that the CA certificate shows the name you entered for the CA certificate that you created in the Issued by field. Click OK. Push the policy to the client machines in the organization. or equivalent. Managing Application Control and URL Filtering Page 33 . Save the CA certificate file. Use the Group Policy Management Console ("Deploying Certificates by Using Group Policy" on page 33) to add the certificate to the Trusted Root Certification Authorities certificate store. This adds the generated CA to the trusted root certificates repository on client machines. is necessary to complete this procedure. 2. To deploy a certificate using Group Policy: 1.

Predefined Rule When you enable HTTPS inspection. the traffic continues to be examined by other blades in the gateway. The primary component of the policy is the Rule Base. For DLP . Do the instructions in the Certificate Import Wizard to find and import the certificate you exported from SmartDashboard. For example. 5. Open Computer Configuration > Windows Settings > Security Settings > Public Key Policies > Trusted Publishers. network objects and custom objects (if defined). In the navigation pane. Find an existing GPO or create a new GPO to contain the certificate settings. Number (No. if the predefined rule inspects all HTTPS traffic from any category and the next rule bypasses traffic from a specified category. 6. When traffic is bypassed or if there is no rule match. The HTTPS Inspection Policy The HTTPS inspection policy determines which traffic is inspected.Select Advanced > HTTPS Inspection > Policy. click Trusted Root Certification Authorities and repeat steps 5-6 to install a copy of the certificate to that store. 7. or organization unit whose users you want affected by the policy. 4. To access the HTTPS inspection Rule Base:  In SmartDashboard. The Group Policy Management Editor opens and shows the current contents of the policy object. The HTTPS Rule Base lets you inspect the traffic on other network blades. open the Policy page:   For Application and URL Filtering and IPS . This rule defines that all HTTPS and HTTPS proxy traffic from any source to the internet is inspected on all blades enabled in the Blade column. the first rule that inspects the traffic is applied. 3. site. This lets you easily make rules for individuals or different groups of users. The blades that HTTPS can operate on are based on the blade contracts and licenses in your organization and can include:      Application Control URL Filtering IPS DLP Anti-Virus If you enable Identity Awareness on your gateways. there are no logs.) The sequence of rules is important because the first rule that matches is applied.HTTPS Inspection 2. By default. Make sure the GPO is associated with the domain. Click Action > Import. Right-click the GPO and select Edit. you can also use Access Role objects as the source in a rule. The rules use the categories defined in the Application and URL Filtering Database.Select Additional Settings > HTTPS Inspection > Policy. a predefined rule is added to the HTTPS Rule Base. Managing Application Control and URL Filtering Page 34 . Parts of the Rule The columns of a rule define the traffic that it matches and if that traffic is inspected or bypassed.

To perform categorization correctly. put your mouse in the column and a plus sign shows. You can also include custom applications. also blocks traffic to and from the Captive Portal. Click the plus sign to open the list of network objects and select one or multiple sources. Important . Important . You can include more services and ports in the inspection by adding them to the services list. The name can include spaces. The source can be an Access Role object.A valid URL Filtering blade contract and license are necessary on the relevant Security Gateways to use the Site Category column. such as SSH are not supported. The default is Any. Services By default. with the Source and Destination parameters defined as Any. Site Category The Site Category column contains the categories for sites and applications that users browse to and you choose to include. This maps the IP address of a site to the relevant domain name. the rule changes to Any. You can select a custom defined application or site object ("Creating Applications or Sites" on page 27) with the Custom button or create a new host or site with the New button at the bottom of the page. sites.gmail. Important . Destination Choose the destination for the traffic.HTTPS Inspection Name Give the rule a descriptive name. For each category. URLs that contain paths are not supported. you can use an object defined as ww. with the Source and Destination parameters defined as Any. also blocks traffic to and from the Captive Portal. Put your mouse in the column and a plus sign shows. Managing Application Control and URL Filtering Page 35 . a single connection to a site must be inspected in some cases regardless of the HTTPS inspection policy.com but not www. To select other HTTPS/HTTP services. The default is the Internet. which includes all traffic with the destination of DMZ or external. Click the plus sign to open the list of network objects and select one or multiple destinations.com/myaccount. Note . the viewer shows a description and if there are applications or sites related with it.gmail. Source The source is where the traffic originates.You can only use custom objects that specify the domain name or host part of a URL. Other services. To add site categories to a rule: Put your mouse in the column and a plus sign shows.A rule that blocks traffic. and hosts. which you can define when Identity Awareness is enabled. One rule can include multiple categories of different types. put your mouse in the column and a plus sign shows. Click the plus sign to open the list of services and select a service. Click the plus sign to open the Category viewer. If you delete the destination value. Double-click in the Name column of the rule to add or change a name.A rule that blocks traffic. To choose other destinations. For example. HTTPS traffic on port 443 and HTTP and HTTPS proxy on port 8080 is inspected. which applies to traffic going to all destinations Important .

Logs the event and executes a command. 2. Action The action is what is done to the traffic. To add a category object to the rule.   Inspect . or runs the script defined in Policy > Global Properties > Log and Alert > Alert Commands User Defined Alert . The alerts are defined by the scripts specified in Policy > Global Properties > Log and Alert > Alert Commands     Blade Choose the blades that will inspect the traffic. You can bypass HTTPS inspection for all Check Point objects. 3. select New. There is one or more log for each session depending on the suppression option. In Hosts List. 4. click the checkbox in the Available list. You can only select a category to add to the rule from the Available list. To see the details of category without adding it to the rule. click the specified button in the toolbar of the viewer. 6. The Hosts/Sites window opens. This is recommended for URL Filtering and IPS updates. or runs the mail alert script defined in Policy > Global Properties > Log and Alert > Alert Commands SNMP Trap . 5. To create a new host site: 1.Records the event's details in SmartView Tracker.Sends one of three possible customized alerts. Enter a name for the host site. You can add a new host site with the New button. In the Category viewer. The options include: Managing Application Control and URL Filtering Page 36 .HTTPS Inspection        To filter the Available list by categories or custom-defined sites. Enter a comment for the host site (optional). If a category is already in a rule. Click OK. Adding a New Host Site You can create a new host site object to use in the HTTPS Rule Base if there is no corresponding existing category. Track Choose if the traffic is logged in SmartView Tracker or if it triggers other notifications. Alert .The traffic is inspected on the blades set in the Blades column.Sends an email to the administrator. click the name of the item in the Available list. The options include:   None . If you used a regular expression in the URL. This option is useful for obtaining general information on your network's traffic. The results will show in the Available list. you can search for it. send an email alert or an SNMP trap alert. Only the domain name part or hosts part of the URL is supported. Click in the column to see the options and select one to add to the rule. Bypass . 8. Click the plus icon in the Site Category column. or run a user-defined script as defined in Policy > Global Properties > Log and Alert > Alert Commands Mail . such as display a popup window.The traffic of source and destination traffic in rules that include the bypass action are not decrypted and inspected. The Available list opens in the left column and then you can add items to the rule. Click in the column and the options open. enter a valid URL and click Add.Does not record the event Log . The new host site is added to the Selected list and can be added to the Rule Base. If you know the name of a category. Click in the column and the options open. Set a color for the host site icon (optional).Sends a SNMP alert to the SNMP GUI. it will not show in the Category viewer. Other HTTPS protections that already operate on traffic will continue to work even when the HTTPS traffic is not decrypted for inspection. 7. click Hosts are defined as regular expressions.

The Security Gateway inspects the traffic and creates a new HTTPS connection from the gateway to the designated server. it must validate the site's server certificate. This option is selected by default. The default is All. A page notifies the user that there is a problem with the website's security certificate. IP address and comments. If the Security Gateway receives a non-trusted server certificate from a site. see sk64521 (https://supportcenter. R75. You can import a CA certificate from another Security Management Server. In the HTTPS Inspection > Policy pane. you can renew the certificate's validity date range if necessary and export it for distribution to the organization's client machines. Bypassing HTTPS Inspection to Software Update Services Check Point dynamically updates a list of approved domain names of services from which content is always allowed. Click list to see the list of approved domain names. If the Security Management Server managing the selected gateway does not have a generated CA certificate installed on it. Select a gateway and click Edit to edit the gateway properties. select Bypass HTTPS Inspection of traffic to well know software update services (list is dynamically updated). This option makes sure that Check Point updates or other 3rd party software updates are not blocked. you see the gateway name. For each gateway. You can also search. For example. Adding Trusted CAs When a client initiates an HTTPS connection to a web site server. updates from Microsoft. by default the user gets a self-signed certificate and not the generated certificate. When the Security Gateway establishes a secure connection (an SSL tunnel) to the designated web site.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutio nid=sk64521). you can add it with Import certificate from file. the Security Gateway intercepts the connection. but lets the user continue to the website. Click the plus sign to open the list of available gateways and select. Java. To bypass HTTPS inspection to software updates: 1.aspx). Gateways Pane The Gateways pane lists the gateways with HTTPS Inspection enabled. Put your mouse in the column and a plus sign shows.com/enus/library/cc751157.microsoft.checkpoint. Before you can import it. There are two options:   You can import a CA certificate already deployed in your organization.20 contains a preconfigured list of trusted CAs. The trusted CAs list is based on the Microsoft Root Certificate Program (http://technet. Install On Choose which gateways the rule will be installed on. you must first export ("Exporting a Certificate from the Security Management Server" on page 33) it from the Security Management Server on which it was created. Managing Application Control and URL Filtering Page 37 . You can change the default setting to block untrusted server certificates ("Server Validation" on page 38).The blade options you see are based on the blade contracts and licenses in your organization. and Adobe. add and remove gateways from here. In the CA Certificate section. which means all gateways that have HTTPS inspection enabled. This list is updated by Check Point.HTTPS Inspection      Application Control Data Loss Prevention IPS URL Filtering Anti-Virus Important . 2.

The certificates will be added or removed respectively from the list. c) Follow the wizard steps. 6. To export a CA certificate: 1. To export a CA certificate to add to the trusted CAs list: 1. Updating the Trusted CAs List Updates for the trusted CAs list will be published periodically on the Check Point web site in a ZIP file. When cleared. 2.  Untrusted server certificate   When selected. Install the security policy on gateways enabled with HTTPS Inspection. The certificate is added to the trusted CAs list. In Internet Explorer and Chrome: a) Click View Certificate. Click Proceed to confirm the update. but lets the user to continue to the website (default). You see the certificates that will be added or removed to the list and the validity date range of the certificates. 3. 2. To import a CA certificate to the Trusted CAs list: 1. 4. browse to the location of the saved certificate and click Open. Temporarily disable HTTPS inspection on the Security Gateway. In Firefox. In SmartDashboard. 3. open HTTPS Inspection > Trusted CAs. HTTPS Validation Server Validation When a Security Gateway receives an untrusted certificate from a web site server. Select the root certificate (the top most certificate in the list). you must export the necessary certificate from a non-trusted web site and then import it into SmartDashboard. Browse to a location.HTTPS Inspection To add a trusted CA to the Security Gateway. Click Actions > Update certificate list. Go to the Certification Path of the certificate. traffic from a site with an untrusted server certificate is immediately dropped. Click Actions > Export to file. the settings in this section define when to drop the connection. export the certificate. 3. b) From the Details tab. In SmartDashboard. Browse to the site to get the certificate issued by the CA.  Revoked server certificate (validate CRL) Managing Application Control and URL Filtering Page 38 . Click Actions > Import certificate. The user gets an error page that states that the browser cannot display the webpage. open HTTPS Inspection > Trusted CAs. Saving a CA Certificate You can save a selected certificate in the trusted CAs list to the local file system. Browse to the ZIP file and click Open. Install the security policy. 5. 2. To update the Trusted CAs list: 1. A CER file is created. enter a file name and click Save. click Copy to File. 7. 4. a self-signed certificate shows on the client machine when there is traffic from an untrusted server. 3. The user is notified that there is a problem with the website's security certificate. open HTTPS Inspection > Trusted CAs. 2. In SmartDashboard.

double-click the Security Gateway that requires proxy configuration. To validate the CRL. The options include: Managing Application Control and URL Filtering Page 39 . or run a user-defined script as defined in Policy > Global Properties > Log and Alert > Alert Commands Mail . The alerts are defined by the scripts specified in Policy > Global Properties > Log and Alert > Alert Commands When selected.lets you delete a certificate in the blacklist. the Security Gateway drops the connection if the server certificate has expired.Lets you add a certificate.Records the event's details in SmartView Tracker Alert . intermediate CA certificates issued by trusted root CA certificates that are not part of the certificate chain are automatically retrieved using the information on the certificate.Logs the event and executes a command. The user can continue to the website (default). the Security Gateway does not check for revocations of server site certificates (default). the Security Gateway validates that each server site certificate is not in the Certificate Revocation List (CRL). Traffic from servers using the certificates in the blacklist will be dropped. you must configure the proxy for the Security Gateway. Remove . or runs the mail alert script defined in Policy > Global Properties > Log and Alert > Alert Commands SNMP Trap . Expired server certificate    Track validation errors Choose if the server validation traffic is logged in SmartView Tracker or if it triggers other notifications. the Security Gateway creates a certificate with the expired date. When cleared. if a proxy server is used in the organization's environment. When selected. will be considered untrusted.HTTPS Inspection  When selected.Does not record the event. Log .      Add . e) Click OK. b) Select Topology > Proxy. the blacklist setting overrides the Trusted CAs list.Lets you change a certificate in the blacklist. Important . the Security Gateway must have access to the internet.   When cleared. To configure the proxy: a) From the Firewall tab. Enter the certificate's serial number (in hexadecimal format HH:HH) and a comment that describes the certificate.Lets you search for a certificate in the blacklist. Track dropped traffic Choose if the dropped traffic is logged in SmartView Tracker or if it triggers other notifications.Sends an SNMP alert to the SNMP GUI. such as shows a popup window.Sends an email to the administrator. For example.     Automatically retrieve intermediate CA certificates   Certificate Blacklisting You can create a list of certificates that are blocked. or runs the script defined in Policy > Global Properties > Log and Alert > Alert Commands User Defined Alert .Sends one of three possible customized alerts. If a certificate in the blacklist is also in the Trusted CAs list. When cleared. Edit . c) Select Use custom proxy settings for this network object and Use proxy server and enter the proxy IP address. d) Optionally.Make sure that there is a rule in the Rule Base that allows outgoing HTTP from the Security Gateway. you can use the default proxy settings. send an email alert or an SNMP trap alert. a web server certificate signed by an intermediate CA certificate which is not sent as part of the certificate chain. The options include:    None . Search .

Records the event's details in SmartView Tracker Alert . send an email alert or an SNMP trap alert.HTTPS Inspection can be applied to these blades:        Application Control URL Filtering IPS DLP Anti-Virus To open SmartView Tracker do one of these: From the SmartDashboard toolbar. The DN in the certificate does not match the actual URL (for example. When cleared. or runs the mail alert script defined in Policy > Global Properties > Log and Alert > Alert Commands SNMP Trap . Possible reasons include:    The generated CA was not deployed on clients ("Exporting and Deploying the Generated CA" on page 33).com). Press Control +Shift +T. Adding the CA certificate to the Windows repository does not solve the problem. HTTPS Inspection Queries These are the predefined queries in Predefined > Network Security Blades > HTTPS Inspection. The alerts are defined by the scripts specified in Policy > Global Properties > Log and Alert > Alert Commands    Troubleshooting Secure connections between a client and server with no traffic create logs in SmartView Tracker labeled as "Client has not installed CA certificate".com. Logs are recorded only when a server certificate is trusted by the Security Gateway. This can happen when an application or client browser fails to validate the server certificate.gmail.HTTPS Inspection    None . such as shows a popup window. when you browse to https://www. logs are recorded for secure connections between a client and server with no traffic in SmartView Tracker (default). Managing Application Control and URL Filtering Page 40 .Shows traffic with connection problems.Sends one of three possible customized alerts. There are two types of predefined queries for HTTPS Inspection logs in SmartView Tracker:   HTTPS Inspection queries Blade queries . the DN in the certificate states mail. HTTPS Validations .Sends an SNMP alert to the SNMP GUI. Log . Applications (such as FireFox and anti-viruses) that use an internal trusted CAs list (other than Windows). a self-signed certificate is created and always results in a log labeled as "Client has not installed CA certificate".Sends an email to the administrator.Shows all HTTPS traffic that matched the HTTPS Inspection policy and was configured to be logged.google. If the server certificate is untrusted.  HTTPS Inspection in SmartView Tracker Logs from HTTPS Inspection are shown in SmartView Tracker. select Window > SmartView Tracker. The option in the HTTPS Validation pane:  Log connections of clients that have not installed the CA certificate  When selected.Logs the event and executes a command. or run a user-defined script as defined in Policy > Global Properties > Log and Alert > Alert Commands Mail .   All .Does not record the event. or runs the script defined in Policy > Global Properties > Log and Alert > Alert Commands User Defined Alert . logs are not recorded for secure connections without traffic that can be caused by not installing the CA certificate on clients or one of the above mentioned reasons.

The log in the blade's queries includes an HTTP Inspection field. 2. In the Administrator Properties > General Properties page in the Permissions Profile field. Permissions for HTTPS Logs An administrator must have HTTPS inspection permissions to see classified data in HTTPS inspected traffic. If the traffic did not go through HTTPS inspection. Select a profile and click Edit. select HTTPS Inspection logs for permission to see the classified information in the HTTPS Inspection logs. 5.  Select Customized and click Edit. HTTPS Inspection in SmartEvent Events from HTTPS Inspection are shown in SmartEvent. From the SmartDashboard toolbar. Managing Application Control and URL Filtering Page 41 . 2. 3. 4.HTTPS Inspection can be applied to these blades:        Application Control URL Filtering IPS DLP Anti-Virus To open SmartEvent do one of these: From the SmartDashboard toolbar. select Window > SmartEvent. the field does not show in the log. 3. There are two types of predefined queries for HTTPS Inspection events in SmartEvent:   HTTPS Inspection queries for HTTPS validations Blade queries . select Manage > Permissions Profiles. The query shows all traffic of the specified blade that passed through HTTPS inspection. To set permissions for an administrator in a new profile: 1. The Permissions Profile Custom Properties window opens. click New. The field value can be inspect or bypass. Follow the instructions above from step 3.HTTPS Inspection   Action values include rejected or detected. The actions are determined by the SSL validation settings ("HTTPS Validation" on page 38) for HTTPS Inspection. Press Control +Shift +T. HTTPS Validation values include:  Untrusted Server Certificate  Server Certificate Expired  Revoked Certificate or Invalid CRL  SSL Protocol Error . In the Users and Administrators tree. To edit an existing permissions profile: 1. In the Permissions Profile Properties window:  Enter a Name for the profile. In the Monitoring and Logging tab. Click OK on all of the open windows. select an administrator > Edit.For general SSL protocol problems Blade Queries When applying HTTPS Inspection to a specified blade:   There is an HTTPS Inspection predefined query for each of the blades that can operate with HTTPS Inspection.

Graphical incident timelines for fast data retrieval. the field does not show in the event record. the Check Point Online Web Service.     Real-time and history graphs of HTTPS Inspection traffic. For example.   Allow all requests (Fail-open) . Block all requests (Fail-close) . Easily configured custom views to quickly view specified queries. and compatibility with gateways from lower versions (Web Browsing application and session unification). Application Control and URL Filtering sessions. SmartEvent shows information for all Software Blades in the environment.All traffic is blocked in a situation of engine overload or failure (default). The query shows all traffic of the specified blade that passed through HTTPS inspection. Incident management workflow. of all events that pass through enabled Security Gateways. The field value can be inspect or bypass. if the application inspection is terminated in the middle for any reason. and more. statistics.All traffic is allowed in a situation of engine overload or failure. charts. Engine Settings On the Advanced > Engine Settings pane. if it is overloaded or fails during inspection. By default. The Details and Summary tabs in the event record show if the traffic was detected or rejected due to SSL Validation settings.  Block requests when the web service is unavailable Managing Application Control and URL Filtering Page 42 .Engine Settings Event Analysis in SmartEvent SmartEvent supplies advanced analysis tools with filtering. configure settings related to engine inspection. Viewing Information in SmartEvent There are two types of predefined queries for HTTPS Inspection events in SmartEvent:   HTTPS Inspection queries Blade queries HTTPS Inspection Queries   Go to Events > Predefined > HTTPS Inspection > HTTPS Validation to shows the SSL validation events that occurred. SmartEvent shows all HTTPS Inspection events. If the traffic did not go through HTTPS inspection. Fail Mode Select the behavior of the Application Control and URL Filtering engine. in such a situation all application and site traffic is blocked. Check Point Online Web Service The Check Point Online Web Service is used by the URL Filtering engine for updated website categorization and by the Application Control engine for updated Widget definitions. You can filter the HTTPS Inspection information for fast monitoring on HTTPS Inspection traffic. The Summary tab in the event record in the blade's queries includes an HTTPS Inspection field. reporting. The responses the Security Gateway gets are cached locally to optimize performance. Blade Queries   There is an HTTPS Inspection predefined query for each of the blades that can operate with HTTPS Inspection.

To make the quantity of logs manageable.Records logs for each URL request made regardless of session.The Web Browsing application includes all HTTP traffic that is not a defined application. When cleared or there is no connectivity between the Security Gateway and the Service.Lets you set different modes for URL Filtering and Social Networking Widgets. it remains blocked until the Check Point Online Web Service completes categorization. No Web Browsing logs are recorded.  Managing Application Control and URL Filtering Page 43 . the Security Gateway connects to the Check Point Online Web Service to identify social networking widgets that it does not recognize (default).configure different settings depending on the service . It shows the initial URL browsed and the number of suppressed logs it includes.Records the event's details in SmartView Tracker. Extended Log . a session is 30 seconds. For applications and sites that are blocked in the Rule Base. requests are allowed when there is no connectivity (default).requests are blocked until categorization is complete . This option also generates an event in SmartEvent for each URL browsed and is intended only for troubleshooting purposes. Each of the URLs has an entry in the URLs tab of the log in SmartView Tracker. Using this option can have an effect on performance.Engine Settings     When selected.When a request cannot be categorized with the cached responses. click Customize to set URL Filtering to Background mode and Social Networking Widgets to Hold mode. The response is then cached locally for future requests (default). Each URL request has its own log. You cannot change this in SmartDashboard.You can select the mode that is used for website categorization:    Use web service to detect Social Network Widgets   Connection Unification Application and URL traffic generate a large quantity of logs.requests are allowed until categorization is complete . All actions that the user does in the session are included in the log. click Session Timeout and enter a different value.   To adjust the length of a session:   For applications and sites that are allowed in the Rule Base. Custom . an uncategorized response is received. the Check Point Online Web Service continues the categorization procedure.When a request cannot be categorized with a cached response. the gateway records one log for each application or site that a user browses to. Background . if you have a rule that blocks Web Browsing.Consolidates logs by session. Web Browsing is enabled by default. When cleared. Complete Log . A session is a period that starts when the user first accesses an application or site. the unknown widget is treated as Web Browsing traffic. you can consolidate logs by session. the default session is three hours (180 minutes). shows the number of suppressed logs and includes data for each URL request in the session time frame. If you disable it:  Instances of the Web Browsing in the Application and URL Filtering Control Rule Base are not enforced. Access to the site is allowed. For example. Web Browsing Enable Web Browsing logging and policy enforcement . For example. This option is useful to get general information on your network's traffic. Website categorization mode . in minutes. To change this. There are 3 tracking options you can use:  Log . During a session. In the background. Hold . When selected. this traffic will not be blocked if Web Browsing is turned off. This option reduces latency in the categorization procedure. It consolidates logs by session (there is one log for each session). requests are blocked when there is no connectivity to the Check Point Online Web Service. Note that this option generates many logs.

criteria matching operates like this:  When identity data for an IP is known:       If it matches an access role. When a Security Gateway receives a packet from a connection. If all the conditions apply. All the rule’s fields match besides the source field with an access role. If this property is added. In rules with access role objects. the rule is applied and the traffic is allowed/blocked based on the action. all application or site traffic during a session is combined into one log (default). If there is no match. When cleared (default). (http://supportcontent. it goes on to examine the next rule. each connection to an application or site generates a different log. you can see which user and IP address accesses which applications. and application awareness to the Check Point gateway. the Action in the rule (Allow or Block) is enforced immediately and the user is not sent to the Captive Portal. click Settings to configure backwards compatibility for use with Application Control. it examines the packet against the first rule in the Rule Base. the packet is allowed. machine awareness. The connection protocol is HTTP. the user is redirected to the Captive Portal. When selected. it goes on to the second rule and continues until it completes the Rule Base. The action is set to redirect to the Captive Portal.  Unify connections from the same user/IP to a specific domain into a single session/log      When selected.Application and URL Filtering and Identity Awareness Application Control Backwards Compatibility For compatibility with gateway versions earlier than R75. When identity data for an IP is unknown and: Managing Application Control and URL Filtering Page 44 . when the source identity is unknown and traffic is HTTP.com/documentation_download?ID=12268) Using Identity Awareness in the Application and URL Filtering Rule Base The Security Gateway inspects Application and URL Filtering requests and applies rules in a sequential manner. When cleared. After the system gets the credentials from the Captive Portal. In SmartView Tracker logs and SmartEvent events. For more details. They work together in these procedures:    Use Identity Awareness Access Roles in Application and URL Filtering rules as the source of the rule. Issue a separate log per each domain accessed Application and URL Filtering and Identity Awareness Identity Awareness and Application and URL Filtering can be used together to add user awareness. all Web Browsing connections from a user or IP address during a session are combined into one log.checkpoint. In rules with access roles. If no rule matches. you can add a property in the Action field to redirect traffic to the Captive Portal.20 Identity Awareness Administration Guide. the Web Browsing application generates one log for each domain that a user or IP address browses to for each session. If the source identity is known.20. it can examine the rule for the next connection. If it does not match an access role. You can use all the types of identity sources to acquire identities of users who try to access applications. the traffic is redirected to the Captive Portal to get credentials and see if there is a match. see the R75.

the Rule Base cannot match taking into account identities. you will see the correct source identities for traffic that goes through the proxy. different users experience different outcomes: Example 1 . In rule 3 there is also no match because the action is not set to redirect to the Captive Portal. on the Identity Awareness page of each gateway object. the user is granted access to the Remote Administration Tool. Application Control and URL Filtering logs show the proxy as their source IP address and not the user's identity. which is added by the proxy server. Identifying Users Behind a Proxy If your organization uses an HTTP proxy server behind the gateway. select Detect users located behind HTTP proxy using X-Forward-For header. When you configure the proxy server to add X-Forward-For HTTP header and the Check Point gateways to use it. To configure the gateway to hide the X Forwarded-For header to not show internal IP addresses in requests to the internet. Example 3 . traffic cannot be redirected to the Captive Portal. The Action column shows that a redirect to the Captive Portal occurs. Managing Application Control and URL Filtering Page 45 .An unidentified user that attempts to access the Remote Administration Tool matches rule 2. you cannot see identities of users behind the proxy. there is no match and the next rule is examined.  When the criteria does not match any of the rules in the Rule Base:  The traffic is allowed. select Hide X Forward-For header in outgoing traffic.Application and URL Filtering and Identity Awareness If not all conditions apply. Application Control. In a rule that uses an access role in the Source column. Since none of the rules match. 3. Because the application is not HTTP. To redirect HTTP traffic to the Captive Portal: 1.An unidentified user that browses to Gmail does not match rules 1 and 2 because of the application. You can also configure the gateways to hide and strip the X-Forward-For header in outgoing traffic so that internal IP addresses will not be seen in requests to the internet.An unidentified Finance user that attempts to access Salesforce is sent to the Captive Portal. 1 Source Finance_Dept (Access Role) Destination Service Applications/Sites Internet Any Salesforce Action Allow (display Captive Portal) Allow 2 Any_identified_user Internet (Access Role) Any Remote Administration Tool (non-HTTP category) Any recognized 3 Any_identified_user Internet (Access Role) Any Block When browsing the Internet. right-click the Action column and select Edit Properties. 2. Select Redirect HTTP connections. 3. Therefore. but not the Source column. the user is granted access to Gmail. Configure your proxy server to use X-Forwarded-For HTTP Header. In SmartDashboard. Click OK. the user is granted access according to rule number 1. This happens because the action is set to redirect to the Captive Portal. URL Filtering and Identity Awareness gateways can use X-Forward-For HTTP header. Since none of the rules match. Example 2 . Install the policy. Below is an example of an Application and URL Filtering Rule Base that shows how criteria matching operates: No. To use X-Forwarded-For HTTP header: 1. to resolve this issue. 2. The Action Properties window opens. After entering credentials and being identified. 4.

therefore. The Web Filter engine is installed on the Security Gateway and the categories are updated by selecting: SmartDashboard > Application & URL Filtering > Legacy URL Filtering > URL Filtering Policy.During installation of the Web Filter engine. the Web Filtering policy is not enforced until a signature update is performed.Legacy URL Filtering Legacy URL Filtering To manage URL Filtering on gateway versions lower than R75. On the URL Filtering Policy page. and one of them is blocked. Network Exceptions: Contains a list of connections for which URL Filtering should not be enforced. Category: Contains a group of topics sharing a common attribute (for example. you must configure automatic updates of the URL Filtering database. Terminology The following terms are used in URL Filtering applications:       Allow List: A list of allowed URL addresses. if the URL address matches two or more categories. the URL header is stripped and the address is sent to the Web Filter engine. The URL Filtering policy is activated if the connection is accepted by the Security Policy. Enable legacy URL filtering (on page 46). 2. The URL is allowed or blocked based on URL request information in the predefined database and/or the Web Filter Allow/Block Lists. depending on your environment. double-click the required Security Gateway network object. For example. To activate URL Filtering. The first update may take a long time. a URL in the Block List is blocked even if it is associated with a category that is not blocked. the URL address is denied. Web Filter: Enables you to allow or block URLs based on network connections and/or an external categorized database and local exception lists. the machine checks the Network Exceptions List to determine whether to enforce the URL Filtering policy. Click OK. Architecture When a URL request arrives at a local machine. however. Important . education and games.20. crime. for example.20: 1. 3. for example. use the Legacy URL Filtering Policy. Subsequent updates should take significantly less time. To enable Legacy URL Filtering on gateway versions lower than R75. configure the following: a) Select one of the following URL Filtering Policy Modes:  On: URL Filtering is active and URLs associated with blocked categories are blocked. 2. Configuring Legacy URL Filtering To configure Legacy URL Filtering: 1. if the same address appears in the Allow List it is accepted. Block List: A list of blocked URL addresses. a URL in the Allow List is allowed even if it is associated with a category that is blocked. If the URL Filtering policy is enforced. On the Firewall tab. In the Application & URL Filtering tab of SmartDashboard. 3. Select Other > More Settings > Enable Legacy URL Filtering. as only incremental information is downloaded. select Legacy URL Filtering > URL Filtering Policy. no default database is installed. Blocking Notifications: Contains the message that appears when a URL address is blocked and the URL to which a blocked URL address is redirected. To Managing Application Control and URL Filtering Page 46 .

Choose one of the options:   Enter the message to be displayed when a URL address is blocked according to the URL Filtering policy. Managing Application Control and URL Filtering Page 47 . Select Advanced > Network Exceptions to create a list of the networks connections through which traffic should not be inspected or in order to enforce URL Filtering on all Web traffic. Network Exceptions works according to a source and destination Rule Base and does not use the URL Filtering engine. Monitor: URLs associated with blocked categories are logged and not blocked. All options other than None generate a log record in SmartView Tracker. 6. select the gateways for which you want to activate URL Filtering. d) In the Tracking section. c) In the Categories list.   A green icon indicates that URLs associated with this category are allowed. Off: URL Filtering is off and does not inspect URL addresses. select how to track a detected URL address. Select Advanced > Block URLs/IPs to add a URL or IP address to be blocked even if it is associated with an allowed category. click the Automatic updates link. select the URL categories to block.Legacy URL Filtering   configure automatic updates. Enter the URL to which the user is to be redirected. b) In the Enforcing Gateways window. URL Filtering will not work if automatic updates have not been configured. 5. A red icon indicates that URLs associated with this category are blocked. Select Advanced > Allow URLs/IPs to add a URL or IP address to be allowed even if it is associated with a blocked category. This window contains all of the gateways for which URL Filtering can and has been enforced. 7. Select Advanced > Blocking Notifications to notify the user when the URL request is blocked. 4.

To make sure that the amount of logs is manageable. The logs that Application Control and URL Filtering generate depend on the Tracking settings that you configure in:  Each Application Control and URL Filtering rule in the Rule Base . the gateway records one log for each application or site that a user accesses.Consolidates logs by session. It shows the initial URL browsed and the number of suppressed logs it includes. extended logs or complete logs:  Log . To see the number of connections made during a session.  Page 48 . a session is 30 seconds. Extended Log . Each of the URLs has an entry in the URLs tab of the log in SmartView Tracker. You can change this in SmartDashboard from the Application and URL Filtering tab > Advanced > Engine Settings > Session Timeout. by default. For applications or sites that are blocked in the Rule Base. It consolidates logs by session (there is one log for each session).  Application Control and URL Filtering Logs Logs from Application Control and URL Filtering are shown in SmartView Tracker.Records the event's details in SmartView Tracker.sets logs for the traffic. the default session is three hours. logs are consolidated by session. These can be regular logs. Session duration for all applications or sites. Using this option can have an effect on performance. All activity that the user does within the session is included in the log. shows the number of suppressed logs and includes data for each URL request in the session time frame. see the Suppressed Logs field of the log in SmartView Tracker. A session is a period that starts when a user first accesses an application or site. including Web Browsing:  For applications or sites that are allowed in the Rule Base. During a session. This option is useful to get general information on your network's traffic. In SmartEvent the number of connections during the session is in the Total Connections field of the Event Details.Chapter 4 Application Control and URL Filtering in SmartView Tracker In This Chapter Log Sessions Application Control and URL Filtering Logs Viewing Logs 48 48 49 Log Sessions Application traffic generates a very large amount of activity.

select an administrator > Edit.  Select Customized and click Edit. Note . High Risk . 4. Note that this option generates many logs. Logs related to Application and URL Filtering Database updates on the management are in the Management tab. 2. Application Control and URL Filtering in SmartView Tracker Page 49 .Shows all Application Control traffic. Viewing Logs To open SmartView Tracker do one of these:    Click Start > Check Point > SmartView Tracker. Permissions for Logs Most information in Application Control and URL Filtering logs is classified and only Administrators with at least Read permissions for Application Control Logs can see it. In the Permissions Profile Properties window:  Enter a Name for the profile.Shows all URL Filtering traffic.Shows logs related to Application and URL Filtering Database updates and other system related issues.sets logging options for the Web Browsing application. More > System . You can filter the queries to focus on logs of interest. More > HTTPS Inspection . Logs related to Application and URL Filtering Database updates on the gateway are in Application Control > System Logs. click New.Shows logs from traffic that has the High Bandwidth tag. Each URL request has its own log. In the Administrator Properties > General Properties page in the Permissions Profile field. 3.Shows all Application Control and URL Filtering traffic. select Window > SmartView Tracker or press Control +Shift +T. Predefined Queries There are multiple predefined queries in Predefined > Network Security Blades > Application and URL Filtering. From the Application and URL Filtering Overview pane > Detected in My Organization. Open SmartDashboard. More > Blocked . The Permissions Profile Custom Properties window opens.Records logs for each URL request made regardless of session.For versions lower than R75. In the Users and Administrators tree. More > Sites . click SmartView Tracker.         All . More > Bandwidth Consuming . including allowed and blocked.Viewing Logs  Complete Log . From the SmartDashboard toolbar of any SmartConsole application.Shows all Application Control and URL Filtering traffic that passed through HTTPS inspection. This option also generates an event in SmartEvent for each URL browsed and is intended only for troubleshooting purposes. To set these permissions for an administrator in a new profile: 1. This includes logs related to problems that the application detection service might encounter.Shows traffic of Risk Levels 4 and 5. More > Applications . the logging option that you select for Session Unification on the Advanced > Engine Settings > Settings page .Shows all blocked traffic.20.

From the SmartDashboard toolbar. In the Monitoring and Logging tab. select Manage > Permissions Profiles. Select a profile and click Edit. To edit an existing permissions profile: 1. select Application Control Logs for permission to see the classified information in the Application Control and URL Filtering logs. Application Control and URL Filtering in SmartView Tracker Page 50 . 6. 3. 2. Follow the instructions above from step 3. Click OK on all of the open windows.Viewing Logs 5.

reporting. statistics. The administrator must have HTTPS Inspection permissions to see classified data in HTTPS inspected traffic. Incident management workflow. If you select Application and URL Filtering as the SmartEvent Intro Mode.      Real-time and historical graphs and reports of application and site traffic. From the Application and URL Filtering Overview pane > Detected in My Organization. it shows the Application Control and URL Filtering information. Easily configured custom views to quickly view specified queries. of all events that travel through enabled Security Gateways. you must enable it on the Security Management Server or on a dedicated machine. and more.Chapter 5 Application Control and URL Filtering in SmartEvent In This Chapter Event Analysis in SmartEvent or SmartEvent Intro Viewing Information in SmartEvent Viewing Information in SmartEvent Intro 51 51 52 Event Analysis in SmartEvent or SmartEvent Intro SmartEvent and SmartEvent Intro supply advanced analysis tools with filtering.checkpoint.checkpoint.20 SmartEvent Intro Administration Guide (http://supportcontent. Graphical incident timelines for fast data retrieval. charts. Reports to data owners on a scheduled basis SmartEvent shows information for all Software Blades in the environment.20 SmartEvent Administration Guide (http://supportcontent. To use SmartEvent or SmartEvent Intro. Page 51 . See either:   R75. You can filter the Application Control and URL Filtering information for fast monitoring and useful reporting on application traffic. SmartEvent Intro shows information for one SmartEvent Intro mode. click More graphs.com/documentation_download?ID=12279) R75.com/documentation_download?ID=12278) Viewing Information in SmartEvent To open SmartEvent do one of these:   Click Start > Check Point > SmartEvent.

Shows all blocked URL Filtering events.20 SmartEvent Administration Guide (http://supportcontent.Shows events of Risk Levels 4 and 5. Select Application and URL Filtering.          All . and Social Networking. Events are grouped by the number of megabytes used. includes allowed and blocked events. Ning. More > By User .  See the R75. More > By Category .Shows all URL Filtering events. More > Blocked . More > HTTPS Inspection . LinkedIN widgets. By default. Viewing Information in SmartEvent Intro To open SmartEvent Intro: 1.Shows all Application Control and URL Filtering events.checkpoint. includes allowed and blocked events. select Window > SmartEvent Intro or press Control +Shift +E. The Overview page includes these panes:       Timeline View Top Users by Traffic Top Application / Site by Traffic Top Applications Categories by Traffic Newly Detected Applications Status Application Control and URL Filtering Event Queries See detailed event queries in the Events tab.Shows all Application Control events.com/documentation_download?ID=12279).Shows events according to the name of the user.   All .Shows Application Control and URL Filtering events that passed through HTTPS inspection. includes allowed and blocked events. High Risk . Application Control and URL Filtering in SmartEvent Page 52 . select Window > SmartEvent or press Control +Shift +A.Shows events by the application/sites category. these include: Facebook widgets.com widgets.Shows events of Risk Levels 4 and 5. More > By Rule Name . includes allowed and blocked events. Double-click on data in any of the sections in the Overview tab to open the associated list of events to investigate issues down to the individual event level. Myspace widgets. High Risk . 2. More > Sites . More > Applications . See the different tabs for detailed information. More > Social Networking . All of the information in SmartEvent Intro is based on Application Control and URL Filtering events.Shows all Application Control and URL Filtering events.Viewing Information in SmartEvent Intro  From the SmartDashboard toolbar of any SmartConsole application. Events are grouped by the number of megabytes used.Shows events by the name of the Application Control or URL Filtering rule that applies to them.Shows events with Application Control social networking categories. When SmartEvent opens. Orkut widgets. From the SmartDashboard toolbar. go to Events > Predefined > Application and URL Filtering to use the predefined queries for Application Control and URL Filtering. The SmartEvent Intro Overview Page The Overview page shows a quick understandable overview of the Application Control and URL Filtering traffic in your environment.

Shows all blocked URL Filtering events.Shows events by the application/sites category.com widgets.Viewing Information in SmartEvent Intro        More > Applications .com/documentation_download?ID=12279).Shows events with Application Control social networking categories. More > HTTPS Inspection .Shows Application Control and URL Filtering events that passed through HTTPS inspection. includes allowed and blocked events. and Social Networking. More > By Category . More > By User . Ning. Myspace widgets. includes allowed and blocked events. Application Control and URL Filtering in SmartEvent Page 53 . LinkedIN widgets. By default. Orkut widgets.Shows events according to the name of the user.Shows events by the name of the Application Control or URL Filtering rule that applies to them.20 SmartEvent Intro Administration Guide (http://supportcontent.Shows all URL Filtering events. More > By Rule Name . these include: Facebook widgets. More > Social Networking .Shows all Application Control events. More > Sites . More > Blocked .checkpoint.  See the R75.

see the R75.you cannot have Authentication (Client. It does not require TAP equipment. a gateway. to monitor the use of applications in your organization. and a SmartDashboard. which is much more expensive.you can only configure it on a gateway The Data Loss Prevention Software Blade NAT of any kind Clusters IPS protections that are performance critical Legacy User Authority features . Benefits of a mirror port include:    There is no risk to your production environment. Check Point version R75 and higher. The mirror port duplicates the network traffic and records the activity in logs.Chapter 6 Setting up a Mirror Port You can configure a mirror port on a Check Point gateway to monitor and analyze network traffic with no effect on your production environment. It requires minimal set-up configuration. Configuring a Mirror Port This section assumes basic knowledge of how to configure a SPAN port in a Cisco switch.20 Installation and Upgrade Page 54 . You can use mirror ports:   As a permanent part of your deployment. you need a Check Point deployment that includes a Security Management Server. For details on how to set this up. Session. In This Chapter Technical Requirements Configuring a Mirror Port 54 54 Technical Requirements You can configure a mirror port on gateways with:         SecurePlatform 32 bit or 64 bit. As an evaluation tool to see the capabilities of the Application Control and IPS blades before you decide to purchase them. To use the mirror port. Mirror ports are not supported with: Management servers. The mirror port does not enforce a policy and therefore you can only use it to see the monitoring and detecting capabilities of the blades. or the equivalent in a Nortel switch. or User) in the Action column of the Firewall Rule Base.

3. Select the interface that you want to remove the mirror-port from. 6. 2. 4. This is the one that you connected. 5. such as Google. Select Define as connected to a mirror port. Enable the Application Control blade in SmartDashboard. contact your Check Point representative. 4. If you only want to enable the IPS blade. Select Configure Connections. Select Network Connections. Install the policy. You should see traffic of the blade you enabled. run: sysconfig. Select Remove the connection to the mirror port. Removing the Mirror Port To remove the mirror port from the interface: 1. For more about evaluating Check Point products or setting up the mirror port. 1. 6. After you configure the interface as a mirror port. you must activate at least one HTTP protection. 3. Connecting the Gateway to the Traffic To connect the gateway to your network traffic: Configure a SPAN port on a switch that your network traffic travels through. Checking that it Works To make sure the mirror port is configured and connected properly:   Browse to an internet site. Install the policy. 2. all of the traffic on the switch is duplicated and sent through this interface. 7. Select Configure Connections. You can also enable the IPS blade to see IPS traffic. Setting up a Mirror Port Page 55 . Select the interface that should be configured as mirror-port. In the command line of the Check Point gateway. 5. Open SmartViewTracker.checkpoint. run: sysconfig.Configuring a Mirror Port Guide (http://supportcontent.com/documentation_download?ID=12269). Select Network Connections. and connect it with a cable to an interface of a Check Point gateway machine. Configuring the Interface as a Mirror Port To set the connected interface as mirror port In the command line of the Check Point gateway.

.

) • 34 Number (NO. 35 Detected in My Organization • 26 E Enabling Application Control on a Gateway • 9 Enabling HTTPS Inspection on a Gateway • 32 Enabling URL Filtering on a Gateway • 10 Engine Settings • 42 Event Analysis in SmartEvent • 41 Event Analysis in SmartEvent or SmartEvent Intro • 51 Exporting a Certificate from the Security Management Server • 33 Exporting and Deploying the Generated CA • 33 Exporting and Importing Applications or Sites • 29 F Fail Mode • 42 G Gateways Pane • 27.D Index A Action • 18. 34 Number (No.) • 16 . 37 Getting Started • 9 Glossary • 8 H How it Operates • 31 HTTP Inspection on Non-Standard Ports • 30 HTTPS Inspection • 31 HTTPS Inspection in SmartEvent • 41 HTTPS Inspection in SmartView Tracker • 40 HTTPS Inspection Queries • 40 HTTPS Validation • 38 B Blade • 36 Blade Queries • 41 Blocking Applications • 12 Blocking Sites • 13 Blocking URL Categories • 14 Bypassing HTTPS Inspection to Software Update Services • 37 I Identifying Users Behind a Proxy • 45 Important Information • 3 Importing a CA Certificate • 32 Install On • 20. 37 Introduction to Application Control and URL Filtering • 6 C Certificate Blacklisting • 39 Check Point Online Web Service • 42 Checking that it Works • 55 Configuring a Mirror Port • 54 Configuring HTTPS Inspection • 31 Configuring Legacy URL Filtering • 46 Configuring the Interface as a Mirror Port • 55 Configuring the Security Gateway for UserCheck • 21 Connecting the Gateway to the Traffic • 55 Connecting to the Internet for Updates • 25 Connection Unification • 43 Creating a CA Certificate • 32 Creating an Application Control and URL Filtering Policy • 10 Creating Application or Site Groups • 28 Creating Applications or Sites • 27 Creating Categories • 28 Creating Rules • 11 Creating UserCheck Interaction Objects • 20 L Legacy URL Filtering • 45 Log Sessions • 48 M Main Features • 7 Managing Application Control and URL Filtering • 15 Messages and Action Items • 26 Monitoring Applications • 11 My Organization • 26 N Name • 16. 36 Adding a New Host Site • 36 Adding Trusted CAs • 37 Advanced Settings for Application and URL Filtering • 30 Application and URL Filtering and Identity Awareness • 44 Application Categories • 23 Application Control and URL Filtering Event Queries • 52 Application Control and URL Filtering in SmartEvent • 51 Application Control and URL Filtering in SmartView Tracker • 48 Application Control and URL Filtering Licensing and Contracts • 9 Application Control and URL Filtering Logs • 48 Application Control Backwards Compatibility • 43 Application Risk Levels • 24 Applications/Sites • 17 Applications/Sites Pane • 27 AppWiki • 26 Architecture • 46 Default Rule and Monitor Mode • 15 Deploying Certificates by Using Group Policy • 33 Destination • 17.

51 Viewing Information in SmartEvent Intro • 52 Viewing Logs • 49 W Web Browsing • 43 Page 58 . 36 Troubleshooting • 40 U Updating the Application and URL Filtering Database • 24 Updating the Trusted CAs List • 38 UserCheck Interaction Objects • 20 Using Identity Awareness Features in Rules • 12 Using Identity Awareness in the Application and URL Filtering Rule Base • 44 Using the AppWiki • 24 V Viewing Information in SmartEvent • 42. 35 T Technical Requirements • 54 Terminology • 46 The Application and URL Filtering Database • 23 The Application and URL Filtering Overview Pane • 26 The Check Point Solution for Application Control and URL Filtering • 7 The HTTPS Inspection Policy • 34 The Need for Application Control • 6 The Need for URL Filtering • 6 The Policy Rule Base • 15 The SmartEvent Intro Overview Page • 52 Top Users • 26 Track • 19.O Overriding Categorization • 30 P Parts of the Rule • 34 Parts of the Rules • 16 Permissions for HTTPS Logs • 41 Permissions for Logs • 49 Predefined Queries • 49 Predefined Rule • 34 R Removing the Mirror Port • 55 S Saving a CA Certificate • 38 Scheduling Updates • 25 Security Category Updates • 23 Server Validation • 38 Services • 35 Setting up a Mirror Port • 54 Site Category • 35 Source • 16.

Master your semester with Scribd & The New York Times

Special offer for students: Only $4.99/month.

Master your semester with Scribd & The New York Times

Cancel anytime.