## R80.x - Performance Tuning Tip - SNI vs. https inspection
| R80.20+ with enabled HTTPS inspection |
| :-- |
If the https **inspection is enabled**, the parameter host from http header can be used for the url because the traffic is analyzed by active streaming. Check Point Active Streaming (CPAS) allow the changing of data, we play the role of “man in the middle”. CPAS breaks the connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.). An application is register to CPAS when a connection start and supply callbacks for event handler and read handler. Several protocols uses CPAS, for example: HTTPS or also VoIP (SIP, Skinny/SCCP, H.323, etc.), Security Servers processes, etc. CPAS breaks the HTTPS connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.)
More read here: [R80.x Security Gateway Architecture (Content Inspection)](https://community.checkpoint.com/t5/General-Topics/R80-x-Security-Gateway-Architecture-Content-Inspection/td-p/41665)
| |
| --- |
| **Tip 1** \- Enable https inspection on the gateway for R80.30 |
\> Gateway & Service > \[Gateway\] > HTTPS Inspection
\> Now creat https rules and configure all blades
| R80.20+ without enabled HTTPS inspection (use SNI) |
| :-- |
If the https inspection is bypassed by https inspection rule, **SNI is used** to recognize the virtual URL for **application control** and **url filtering**.
SNI is investigated during TLS Handshake it inspect the ‘Client Hello’ SNI field and
the server name in ‘Server Hello’. The subject field content is compared with the server name. If subject contains a Wildcard the content of subject alt name field is inspected: A valid certificate would include the server name here.
For more informations about URL Filtering see sk92743.
More read here: [URL Filtering using SNI for HTTPS websites.pdf](https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/general-topics/10433/1/URL%20Filtering%20using%20SNI%20for%20HTTPS%20websites.pdf)
| |
| --- |
| **Tip 2** \- Enable SNI without https inspection in R80.30 for “Application Control & URL Filtering Settings” |
\> Gateway & Service > \[Gateway\] > HTTPS Inspection
\> Creat HTTPS bypass rule
\> Management & Settings > Blades > Application Control > Advanced Settings
| |
| --- |
| **Tip 3** \- Performance view SNI vs. HTTPS inspection |
From a performance view, it is more effective to use the SNI function if you only use URL filtering and application control.
| Chapter |
| :-- |
**More interesting articles:** [\- R80.x Architecture and Performance Tuning - Link Collection](https://community.checkpoint.com/t5/General-Topics/R80-x-Architecture-and-Performance-Tuning-Link-Collection/m-p/47883#M9336)
[\- Article list (Heiko Ankenbrand)](http://cp.ankenbrand24.de/)
➜ CCSM Elite, CCME, CCTE, CCVS ➜ www.checkpoint.tips
- Tags:
- [app](https://community.checkpoint.com/t5/tag/app/tg-p/board-id/general-topics)
- [application control](https://community.checkpoint.com/t5/tag/application%20control/tg-p/board-id/general-topics)
- [caps](https://community.checkpoint.com/t5/tag/caps/tg-p/board-id/general-topics)
- [https](https://community.checkpoint.com/t5/tag/https/tg-p/board-id/general-topics)
- [https inspection](https://community.checkpoint.com/t5/tag/https%20inspection/tg-p/board-id/general-topics)
[8\\
\\
\\
Kudos](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/14370/tab/all-users "Click here to see who gave kudos to this post.")
[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/70970?t:ac=board-id/general-topics/message-id/14370/thread-id/14370&t:cp=kudos/contributions/tapletcontributionspage&ticket=-j1ZsMvVbboB_-1 "Click here to give kudos to this post.")
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
[(1)](https://community.checkpoint.com/t5/ratings/ratingdetailpage/message-uid/70970/rating-system/message_ratings#userlist "5 Average Rating")
[Reply](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970)
- [All forum topics](https://community.checkpoint.com/t5/General-Topics/bd-p/general-topics/page/304 "General Topics")
- [Previous Topic](https://community.checkpoint.com/t5/General-Topics/Shared-public-IP-for-IPSEC-Site-to-Site-and-Client-to-Site-VPN/td-p/84371 "Shared public IP for IPSEC Site to Site and Client to Site VPN")
- [Next Topic](https://community.checkpoint.com/t5/General-Topics/How-to-logout/td-p/84422 "How to logout?")
4 Replies
[PhoneBoy](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7)
Admin
2019-12-2011:04 AM
[Show option menu](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970# "Show option menu")
- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=14384)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/71012/highlight/true#M14384)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/14384/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/71012)
Hi, one error here: in R80.30x , HTTPS Inspection must be enabled for SNI Verification to take place.
I believe you can leave a bypass rule as the only rule and it should still work.
Believe this limitation will be removed in R80.40.
[4\\
\\
\\
Kudos](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/14384/tab/all-users "Click here to see who gave kudos to this post.")
[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/71012?t:ac=board-id/general-topics/message-id/14370/thread-id/14370&t:cp=kudos/contributions/tapletcontributionspage&ticket=-j1ZsMvVbboB_-1 "Click here to give kudos to this post.")
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
[Reply](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970)
[HeikoAnkenbrand](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/21670)
MVP Diamond
2019-12-2109:56 AM
[Show option menu](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970# "Show option menu")
- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=14390)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/71032/highlight/true#M14390)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/14390/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/71032)
[In response to PhoneBoy](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/71012/highlight/true#M14384)
Yes, you're right. 👍
I have already written it for R80.40 EA. I have now changed it to R80.30.
R80.40 settings follow if it is GA:-)
➜ CCSM Elite, CCME, CCTE, CCVS ➜ www.checkpoint.tips
[5\\
\\
\\
Kudos](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/14390/tab/all-users "Click here to see who gave kudos to this post.")
[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/71032?t:ac=board-id/general-topics/message-id/14370/thread-id/14370&t:cp=kudos/contributions/tapletcontributionspage&ticket=-j1ZsMvVbboB_-1 "Click here to give kudos to this post.")
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
[Reply](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970)
[Kyu\_Jung](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/12070)
Participant
2020-01-0710:48 PM
[Show option menu](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970# "Show option menu")
- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=14554)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/71823/highlight/true#M14554)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/14554/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/71823)
[In response to HeikoAnkenbrand](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/71032/highlight/true#M14390)
It works as described in this article.
[1\\
\\
\\
Kudo](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/14554/tab/all-users "Click here to see who gave kudos to this post.")
[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/71823?t:ac=board-id/general-topics/message-id/14370/thread-id/14370&t:cp=kudos/contributions/tapletcontributionspage&ticket=-j1ZsMvVbboB_-1 "Click here to give kudos to this post.")
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
[Reply](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970)
[Andrejs\_\_Андрей](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/8484)
Contributor
2020-05-0812:44 AM
[Show option menu](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970# "Show option menu")
- Mark as New
- Bookmark
- Subscribe
- Mute
- [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=general-topics&message.id=17054)
- [Permalink](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/84537/highlight/true#M17054)
- [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/general-topics/message-id/17054/print-single-message/true/page/1)
- [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/84537)
for Tip2...
you can enable bypass also via cli:
fw ctl set int bypass\_on\_enhanced\_ssl\_inspection 1
regards,
--
ak.
[1\\
\\
\\
Kudo](https://community.checkpoint.com/t5/kudos/messagepage/board-id/general-topics/message-id/17054/tab/all-users "Click here to see who gave kudos to this post.")
[Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/84537?t:ac=board-id/general-topics/message-id/14370/thread-id/14370&t:cp=kudos/contributions/tapletcontributionspage&ticket=-j1ZsMvVbboB_-1 "Click here to give kudos to this post.")
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
[Reply](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970)
Post Reply
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
| --- | --- |
|
[israelfds95](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/93117) | 13 |
|
[HeikoAnkenbrand](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/21670) | 7 |
|
[simonemantovani](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/79070) | 5 |
|
[emmap](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/71054) | 3 |
|
[Steffen\_Appel](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/10477) | 2 |
|
[Kaspars\_Zibarts](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/11456) | 1 |
|
[Alex-](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/10384) | 1 |
|
[Danny](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/687) | 1 |
|
[Bob\_Zimmerman](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/27871) | 1 |
|
[DH](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/25118) | 1 |
[View All ≫](https://community.checkpoint.com/t5/forums/kudosleaderboardpage/board-id/general-topics/timerange/one_month/page/1/tab/authors)
Trending Discussions
[Five Habits That Improved My Check Point Deployments](https://community.checkpoint.com/t5/General-Topics/Five-Habits-That-Improved-My-Check-Point-Deployments/td-p/279760)
[Automatically Renew VPN Certificates](https://community.checkpoint.com/t5/General-Topics/Automatically-Renew-VPN-Certificates/td-p/279072)
[Snapshot and /boot disk space full](https://community.checkpoint.com/t5/General-Topics/Snapshot-and-boot-disk-space-full/td-p/280183)
Upcoming Events
Sort by:
- [All](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970#)
- [Virtual](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970#)
- [In-Person](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970#)
[Virtual](https://community.checkpoint.com/labels/Virtual)
Tue 28 Jul 2026 @ 11:00 AM (EDT)
[Under the Hood - Check Point and Illumio – Modern Network Defense Against AI-Based Threats](https://community.checkpoint.com/t5/CheckMates-Events/Under-the-Hood-Check-Point-and-Illumio-Modern-Network-Defense/ev-p/279701)
[Virtual](https://community.checkpoint.com/labels/Virtual)
Wed 29 Jul 2026 @ 12:00 PM (SGT)
[The AI Security Report 2026: A Turning Point for Enterprise Defense - SGT](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280019)
[Virtual](https://community.checkpoint.com/labels/Virtual)
Wed 29 Jul 2026 @ 02:00 PM (IDT)
[The AI Security Report 2026: A Turning Point for Enterprise Defense - AMER](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280021)
[Virtual](https://community.checkpoint.com/labels/Virtual)
Wed 29 Jul 2026 @ 03:00 PM (CEST)
[The AI Security Report 2026: A Turning Point for Enterprise Defense EMEA](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280020)
[Virtual](https://community.checkpoint.com/labels/Virtual)
Wed 29 Jul 2026 @ 11:00 AM (EDT)
[TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370)
Thu 30 Jul 2026 @ 11:30 AM (CDT)
[CheckMates Live DFW: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/CheckMates-Live-DFW-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279920)
[Virtual](https://community.checkpoint.com/labels/Virtual)
Tue 28 Jul 2026 @ 11:00 AM (EDT)
[Virtual](https://community.checkpoint.com/labels/Virtual)
Wed 29 Jul 2026 @ 12:00 PM (SGT)
[Virtual](https://community.checkpoint.com/labels/Virtual)
Wed 29 Jul 2026 @ 02:00 PM (IDT)
[Virtual](https://community.checkpoint.com/labels/Virtual)
Wed 29 Jul 2026 @ 03:00 PM (CEST)
[Virtual](https://community.checkpoint.com/labels/Virtual)
Wed 29 Jul 2026 @ 11:00 AM (EDT)
[TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370)
[Virtual](https://community.checkpoint.com/labels/Virtual)
Thu 30 Jul 2026 @ 10:00 AM (PDT)
[AI Security Masters E12: READY OR NOT: Securing the AI Enterprise 4/5 - AI Gateway](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Masters-E12-READY-OR-NOT-Securing-the-AI-Enterprise/ev-p/277411)
[In-Person](https://community.checkpoint.com/labels/In-Person)
Tue 11 Aug 2026 @ 11:30 AM (EDT)
[New York City: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/New-York-City-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279476)
[In-Person](https://community.checkpoint.com/labels/In-Person)
Thu 13 Aug 2026 @ 11:30 AM (EDT)
[Waltham, MA: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/Waltham-MA-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279475)
[In-Person](https://community.checkpoint.com/labels/In-Person)
Thu 20 Aug 2026 @ 08:30 AM (COT)
[Medellin: Workspace Evolution: Hybrid Mesh Management - Visibilidad, Automatización e IA](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Evolution-Hybrid-Mesh-Management-Visibilidad/ev-p/280003)
[In-Person](https://community.checkpoint.com/labels/In-Person)
Thu 20 Aug 2026 @ 06:00 PM (COT)
[Medellin: Workspace Intelligence: IA Generativa en Acción para Equipos de Seguridad](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Intelligence-IA-Generativa-en-Acci%C3%B3n-para/ev-p/280004)
[In-Person](https://community.checkpoint.com/labels/In-Person)
Thu 27 Aug 2026 @ 09:00 AM (CEST)
[Check Point Hands-On SASE and Cloud Workshop - Zurich](https://community.checkpoint.com/t5/CheckMates-Events/Check-Point-Hands-On-SASE-and-Cloud-Workshop-Zurich/ev-p/279914)
[In-Person](https://community.checkpoint.com/labels/In-Person)
Wed 21 Oct 2026 @ 09:00 AM (BST)
[AI Security Workshop - Glasgow](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Workshop-Glasgow/ev-p/278505)
[CheckMates Events](https://community.checkpoint.com/t5/CheckMates-Events/eb-p/events)
[Top](https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-SNI-vs-https-inspection/m-p/70970)
About CheckMates
- [Getting Started & FAQ](https://community.checkpoint.com/t5/help/faqpage)
- [Community Guidelines](https://community.checkpoint.com/t5/user/TermsOfServicePage)
Learn Check Point
- [Check Point for Beginners](https://community.checkpoint.com/t5/Check-Point-for-Beginners-2-0/bg-p/check-point-for-beginners-2-0)
- [Check Point Trivia](https://community.checkpoint.com/t5/Check-Point-Trivia/bg-p/trivia)
- [CheckFlix Videos](https://community.checkpoint.com/t5/CheckFlix/ct-p/checkflix)
Advanced Learning
- [Check Point Security Masters](https://community.checkpoint.com/t5/Check-Point-Security-Masters/gp-p/ccsm)
- [Tip of the Week](https://community.checkpoint.com/t5/SecureKnowledge-Tip-of-the-Week/bg-p/secureknowledge)
- [TechTalks](https://community.checkpoint.com/t5/TechTalks/ct-p/techtalks%20role=)
- [Training and Certification](https://community.checkpoint.com/t5/Training-and-Certification/bd-p/training-and-certification)
Resources
- [CheckMates Toolbox](https://community.checkpoint.com/t5/CheckMates-Toolbox/ct-p/CheckMatesToolbox)
- [Developers (Code Hub)](https://community.checkpoint.com/t5/Developers-API-CLI/bd-p/codehub)
- [Product Announcements](https://community.checkpoint.com/t5/Product-Announcements/bg-p/products-blog)
- [Upcoming Events](https://community.checkpoint.com/t5/Upcoming-Events/bg-p/checkmates-live)
Non-English Discussions
- [Español](https://community.checkpoint.com/t5/Espa%C3%B1ol/bd-p/spanish)
- [French](https://community.checkpoint.com/t5/Fran%C3%A7ais/bd-p/francais)
- [Japanese](https://community.checkpoint.com/t5/Japanese-%E6%97%A5%E6%9C%AC%E8%AA%9E/bd-p/Japanese)
- [Português](https://community.checkpoint.com/t5/Portugu%C3%AAs/bd-p/portuguese)
- [Russian](https://community.checkpoint.com/t5/Russian/bd-p/russian)
- [Chinese](https://community.checkpoint.com/t5/Chinese/bd-p/taiwan)
YOU DESERVE THE BEST SECURITY
We’re Social. Follow Us [CheckMates on LinkedIn](http://linkedin.com/company/cpcheckmates) [Check Point on YouTube](https://www.youtube.com/user/CPGlobal) [CheckMates on Facebook](https://www.facebook.com/cpcheckmates/) [CheckMates on Instagram](https://www.instagram.com/cpcheckmates/)
©1994-2026 Check Point Software Technologies Ltd. All rights reserved. [Copyright](https://www.checkpoint.com/copyright/) [Privacy Policy](https://www.checkpoint.com/privacy/) [About Us](https://www.checkpoint.com/about-us/) [UserCenter](https://usercenter.checkpoint.com/)
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.