Application control matches only Web Browsing - Check Point CheckMates
Application control matches only Web Browsing
Hello everyone,
I've done a migration from R80 to R80.10 and now I only see "Web Browsing" application in App Control logs:
All access is caught by URL filtering, but only the blocks match to their specific rules. A rule which allows facebook gets no hits, yet all facebook traffic matches the clean up any - any - any - allow:
Here is an example of app control log:
The gateway is an SMB 1470 appliance running R77.20.60.
There are separate layers for Network and Application rules as required for R77. All logging is set to extended.
Is this a gateway limitation or a configuration issue?
Tags:
0
Kudos
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
10 Replies
Contributor
2017-07-3102:04 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HTTPS inspection enabled ?
0
Kudos
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Employee
2017-08-0106:55 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes! But I get the same result for inspected and bypassed traffic.
The policy in R80.10 is the same as it was in R80, when it worked fine.
0
Kudos
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Participant
2017-07-3103:26 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Totally agree with Aner.
I had a similar issue in the past with anonymizers, we could identify Tor traffic but couldn't apply any policies to it without HTTPS inspection.
0
Kudos
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Employee
2017-08-0106:58 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In response to Federico_Meine1
So you solved the issue by enabling HTTPS inspection?
0
Kudos
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Participant
2017-08-0107:37 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In response to Pedro_Espindola
I didn't had the experience with Facebook/Twitter, by enabling HTTPS we could block Tor traffic via AppControl/URL Filtering. Try it in a lab enviroment first.
Also keep in mind that HTTPS Inspection is highly resource demanding in the gateway side. If you have your network segmented is best to implement it by phases by adding exceptions and see the impact in CPU/Memory.
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Employee
2017-08-0108:23 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In response to Federico_Meine1
HTTPS is already enabled and blocking https malware, I tested it. I tried disabling it and got the exact same result. It is back on.
It has been enabled and working beautifully with central management since R77.30 + Addon and then R80.
I've noticed some differences when upgrading to R80.10.
- In R80, when some scope (network or host) was not explicitly defined for inspection or bypass in the https inspection rulebase it was NOT inspected.
- After upgrading to R80.10, I had to explicitly set the bypass for those networks or they would be inspected.
I have not found documentation that explains the differences.
Most of the network IS inspected, including the machine I am using to test, obviously.
CPU/Memory is not an issue. The number of users and throughput is much lower than supported by the appliance. Memory is usually at 40% at most. CPU is usually at 10%.
0
Kudos
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Admin
2017-08-0108:26 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Make sure you have logging configured as described in this thread: https://community.checkpoint.com/message/6785-rules-with-any-applicationservice-not-logging-applicat...
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Employee
2017-08-0206:34 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your reply, Dameon. I was the one that asked that other question. The logging mode is set for extended. In that one the issue was a R80.10 gateway. Now it is a preR80 1470, which doesn't have multiple logging modes.
The problem here is a little different, it is not just the logs, it seems. Application Control is not matching the applications correctly and all allowed traffic is processed at the Clean Up. URL filtering is correctly matching most of the blocked sites at the correct rule, except for "High Risk Applications", which are being allowed as "Web browsing". Look at the screenshot below. Facebook traffic doesn't match this rule and is allowed at the last rule.
Maybe this question should be moved to another category.
0
Kudos
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Admin
2017-08-0207:23 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In response to Pedro_Espindola
Can you post a screenshot of the rule that it should match?
Also if you haven't already, I would start a case with the Check Point TAC.
0
Kudos
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Employee
2017-08-0310:52 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Turns out, the good old REBOOT solved the problem...
Unfortunately we won't know what caused it.
Thank you all for the help, guys.
Click here to give kudos to this post.
1
2
3
4
5
0.5
1.0
1.5
2.0
2.5
3.0
3.5
4.0
4.5
5.0
Post Reply
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
|---|---|
sx8n20394 |
7 |
israelfds95 |
7 |
jorgeluiznim |
5 |
velo |
1 |
BikeMan |
1 |
emmap |
1 |
CEEJAY |
1 |
Max_Leorne |
1 |
Chris_Atkinson |
1 |
Trending Discussions
Reach My Device – A Native Option for Secure Remote Access to Quantum Spark Appliances
Downgrading a Quantum Spark Appliance: From 'Upgrade Not Supported' to a Working Boot Loader Recover
L2TP Remote Access VPN - Can't Connect on SMB 2550 R82.00.10
Upcoming Events
Sort by:
Tue 28 Jul 2026 @ 11:00 AM (EDT)
Under the Hood - Check Point and Illumio – Modern Network Defense Against AI-Based Threats
Wed 29 Jul 2026 @ 12:00 PM (SGT)
The AI Security Report 2026: A Turning Point for Enterprise Defense - SGT
Wed 29 Jul 2026 @ 02:00 PM (IDT)
The AI Security Report 2026: A Turning Point for Enterprise Defense - AMER
Wed 29 Jul 2026 @ 03:00 PM (CEST)
The AI Security Report 2026: A Turning Point for Enterprise Defense EMEA
Wed 29 Jul 2026 @ 11:00 AM (EDT)
TechTalk: On-Premise SD-WAN Management
Thu 30 Jul 2026 @ 11:30 AM (CDT)
CheckMates Live DFW: Agentic AI Security Deep Dive & Hands-On
Tue 28 Jul 2026 @ 11:00 AM (EDT)
Wed 29 Jul 2026 @ 12:00 PM (SGT)
Wed 29 Jul 2026 @ 02:00 PM (IDT)
Wed 29 Jul 2026 @ 03:00 PM (CEST)
Wed 29 Jul 2026 @ 11:00 AM (EDT)
TechTalk: On-Premise SD-WAN Management
Thu 30 Jul 2026 @ 10:00 AM (PDT)
AI Security Masters E12: READY OR NOT: Securing the AI Enterprise 4/5 - AI Gateway
Tue 11 Aug 2026 @ 11:30 AM (EDT)
New York City: Agentic AI Security Deep Dive & Hands-On
Thu 13 Aug 2026 @ 11:30 AM (EDT)
Waltham, MA: Agentic AI Security Deep Dive & Hands-On
Thu 20 Aug 2026 @ 08:30 AM (COT)
Medellin: Workspace Evolution: Hybrid Mesh Management - Visibilidad, Automatización e IA
Thu 20 Aug 2026 @ 06:00 PM (COT)
Medellin: Workspace Intelligence: IA Generativa en Acción para Equipos de Seguridad
Thu 27 Aug 2026 @ 09:00 AM (CEST)
Check Point Hands-On SASE and Cloud Workshop - Zurich
Wed 21 Oct 2026 @ 09:00 AM (BST)
AI Security Workshop - Glasgow
About CheckMates
Learn Check Point
Advanced Learning
Resources
Non-English Discussions
YOU DESERVE THE BEST SECURITY
We’re Social. Follow Us CheckMates on LinkedIn Check Point on YouTube CheckMates on Facebook CheckMates on Instagram
©1994-2026 Check Point Software Technologies Ltd. All rights reserved. Copyright Privacy Policy About Us UserCenter
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.