R80.x - Performance Tuning Tip - SNI vs. https ins... - Check Point CheckMates
R80.x - Performance Tuning Tip - SNI vs. https inspection
| R80.20+ with enabled HTTPS inspection |
|---|
If the https inspection is enabled, the parameter host from http header can be used for the url because the traffic is analyzed by active streaming. Check Point Active Streaming (CPAS) allow the changing of data, we play the role of “man in the middle”. CPAS breaks the connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.). An application is register to CPAS when a connection start and supply callbacks for event handler and read handler. Several protocols uses CPAS, for example: HTTPS or also VoIP (SIP, Skinny/SCCP, H.323, etc.), Security Servers processes, etc. CPAS breaks the HTTPS connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.)
More read here: R80.x Security Gateway Architecture (Content Inspection)
| Tip 1 - Enable https inspection on the gateway for R80.30 |
> Gateway & Service > [Gateway] > HTTPS Inspection
> Now creat https rules and configure all blades
| R80.20+ without enabled HTTPS inspection (use SNI) |
|---|
If the https inspection is bypassed by https inspection rule, SNI is used to recognize the virtual URL for application control and url filtering.
SNI is investigated during TLS Handshake it inspect the ‘Client Hello’ SNI field and
the server name in ‘Server Hello’. The subject field content is compared with the server name. If subject contains a Wildcard the content of subject alt name field is inspected: A valid certificate would include the server name here.
For more informations about URL Filtering see sk92743.
More read here: URL Filtering using SNI for HTTPS websites.pdf
| Tip 2 - Enable SNI without https inspection in R80.30 for “Application Control & URL Filtering Settings” |
> Gateway & Service > [Gateway] > HTTPS Inspection
> Creat HTTPS bypass rule
> Management & Settings > Blades > Application Control > Advanced Settings
| Tip 3 - Performance view SNI vs. HTTPS inspection |
From a performance view, it is more effective to use the SNI function if you only use URL filtering and application control.
| Chapter |
|---|
More interesting articles: - R80.x Architecture and Performance Tuning - Link Collection
- Article list (Heiko Ankenbrand)
➜ CCSM Elite, CCME, CCTE, CCVS ➜ www.checkpoint.tips
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
4 Replies
Admin
2019-12-2011:04 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, one error here: in R80.30x , HTTPS Inspection must be enabled for SNI Verification to take place.
I believe you can leave a bypass rule as the only rule and it should still work.
Believe this limitation will be removed in R80.40.
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
MVP Diamond
2019-12-2109:56 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you're right. 👍
I have already written it for R80.40 EA. I have now changed it to R80.30.
R80.40 settings follow if it is GA:-)
➜ CCSM Elite, CCME, CCTE, CCVS ➜ www.checkpoint.tips
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Participant
2020-01-0710:48 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In response to HeikoAnkenbrand
It works as described in this article.
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Contributor
2020-05-0812:44 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
for Tip2...
you can enable bypass also via cli:
fw ctl set int bypass_on_enhanced_ssl_inspection 1
regards,
--
ak.
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Post Reply
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
|---|---|
israelfds95 |
13 |
HeikoAnkenbrand |
7 |
simonemantovani |
5 |
emmap |
3 |
Steffen_Appel |
2 |
Kaspars_Zibarts |
1 |
Alex- |
1 |
Danny |
1 |
Bob_Zimmerman |
1 |
DH |
1 |
Trending Discussions
Five Habits That Improved My Check Point Deployments
Automatically Renew VPN Certificates
Snapshot and /boot disk space full
Upcoming Events
Sort by:
Tue 28 Jul 2026 @ 11:00 AM (EDT)
Under the Hood - Check Point and Illumio – Modern Network Defense Against AI-Based Threats
Wed 29 Jul 2026 @ 12:00 PM (SGT)
The AI Security Report 2026: A Turning Point for Enterprise Defense - SGT
Wed 29 Jul 2026 @ 02:00 PM (IDT)
The AI Security Report 2026: A Turning Point for Enterprise Defense - AMER
Wed 29 Jul 2026 @ 03:00 PM (CEST)
The AI Security Report 2026: A Turning Point for Enterprise Defense EMEA
Wed 29 Jul 2026 @ 11:00 AM (EDT)
TechTalk: On-Premise SD-WAN Management
Thu 30 Jul 2026 @ 11:30 AM (CDT)
CheckMates Live DFW: Agentic AI Security Deep Dive & Hands-On
Tue 28 Jul 2026 @ 11:00 AM (EDT)
Wed 29 Jul 2026 @ 12:00 PM (SGT)
Wed 29 Jul 2026 @ 02:00 PM (IDT)
Wed 29 Jul 2026 @ 03:00 PM (CEST)
Wed 29 Jul 2026 @ 11:00 AM (EDT)
TechTalk: On-Premise SD-WAN Management
Thu 30 Jul 2026 @ 10:00 AM (PDT)
AI Security Masters E12: READY OR NOT: Securing the AI Enterprise 4/5 - AI Gateway
Tue 11 Aug 2026 @ 11:30 AM (EDT)
New York City: Agentic AI Security Deep Dive & Hands-On
Thu 13 Aug 2026 @ 11:30 AM (EDT)
Waltham, MA: Agentic AI Security Deep Dive & Hands-On
Thu 20 Aug 2026 @ 08:30 AM (COT)
Medellin: Workspace Evolution: Hybrid Mesh Management - Visibilidad, Automatización e IA
Thu 20 Aug 2026 @ 06:00 PM (COT)
Medellin: Workspace Intelligence: IA Generativa en Acción para Equipos de Seguridad
Thu 27 Aug 2026 @ 09:00 AM (CEST)
Check Point Hands-On SASE and Cloud Workshop - Zurich
Wed 21 Oct 2026 @ 09:00 AM (BST)
AI Security Workshop - Glasgow
About CheckMates
Learn Check Point
Advanced Learning
Resources
Non-English Discussions
YOU DESERVE THE BEST SECURITY
We’re Social. Follow Us CheckMates on LinkedIn Check Point on YouTube CheckMates on Facebook CheckMates on Instagram
©1994-2026 Check Point Software Technologies Ltd. All rights reserved. Copyright Privacy Policy About Us UserCenter
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.