[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 5963
  • Last Modified:

CheckPoint Firewall - Reverse Proxy

Hi,

Could we use Checkpoint in order to implement a reverse proxy. We need to do reverse proxy for the Exchange 2010 CAS servers.

Thank you.
0
llarava
Asked:
llarava
  • 2
1 Solution
 
JamesMcBrideCommented:
I don't believe FW-1 supports reverse proxy in the way that ISA does with a two-step SSL process.  You would either need to put ISA / TMG behind your Checkpoint Firewall, or don't proxy it and just NAT the traffic directly to your CAS servers.
0
 
cmoormannCommented:
Could we use Checkpoint in order to implement a reverse proxy. We need to do reverse proxy for the  Exchange 2010 CAS servers.

Yes and no. The once standalone Connectra appliance (similar to Citrix Access Gateway/Netscaler) was moved into a software blade in the checkpoint firewall but is a bit different then a normal reverse proxy.
This blade provides at a basic level SSL VPN, where you i.e login through a web portal and then being  matched against the security policy, installed av software (NAC like) and so on and can then access resources in your internal network, similar to a normal vpn client.

In addition one can provide a webportal/services, which provide your internal resources without exposing them directly to the vpn user. Fileshares, Webmail (i.e. OWA), active sync, Citrix and applications or a "secure browser".

For webmail there is explicit support for OWA  with single i.e. sign on and specific application security settings that can be applied. Unfortunately the last supported version is OWA 2007 with R75.20.

Of course you can apply user/object/time restrictions and virus scanning on all published services.

There is a 155 pages Mobile Access manual that can be downloaded with a normal user registration:
Mobile Access Manual




0
 
llaravaAuthor Commented:
cmoormann: Is this available on the R65 FW1?  
0
 
cmoormannCommented:
Is this available on the R65 FW1
Negative. When doing this with R65, you had to resort to buy a standalone Checkpoint Connectra appliance. The connectra though is end of life, as is R65. The functionality has been incorporated into R75.
0

Featured Post

IT Degree with Certifications Included

Aspire to become a network administrator, network security analyst, or computer and information systems manager? Make the most of your experience as an IT professional by earning your B.S. in Network Operations and Security.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now