How to allow checkpoint SSL extender

Hello IT Manager,

I'm not sure I understand correctly what works and what doesn't, so allow me some questions:
staproxy.exe is downloaded to %TEMP% regardless of the settings?
At this point you can manually start staproxy.exe and clicking the connect button again the connection is established?
In order to allow it to run automatically you have to turn off Web Protection and Web Control (completely off as warn causes it to fail)?

It's somewhat strange that neither the AV nor the WC log show a message, and also that it can be run manually. Sysinternal's (Microsoft's) Process Monitor would show whether staproxy.exe isn't run at all or quickly quits after performing some checks.

Christian 

Hi Christian

Staproxy.exe and its relevant dlls. etc are downloaded to the temp folder inside its own folder regardless of settings. I tested by deleting the folder and watching it recreate while the AV and WC modules were enabled.

I had a play last night and did notice that with the AV and WC settings are enabled, the staproxy.exe IS run but very quickly closed. No logs are shown unfortunately, so I am unsure what module/list, etc is blocking it when automatically loaded.

I am presuming I can run it manually as it's outside the web monitoring scope of Sophos and treated as a normal file access, which the file level AV module has no issue with.

Hello IT Manager,

dunno what WC (or WP) apparently quietly does here - guess you'll need help from Support.

Christian

Hi Christian,

Just to advise that I'm seeing the exact same issue in our organisation.

To be specific, I'm logging into a webpage without issue, and am presented with a 'connect' button, which when used attempts to install/run Checkpoint SSL Network Extender. This will fail after only a few seconds.

If I then stop the Sophos Web Filter service, the connection-attempt works without issue.

Also, If I leave that Sophos Web Filter service alone (running), but go to the TEMP folder (in my case, c:\users\<myname>\AppData\Local\Temp\Low), run (double-click) STAProxy.exe and then click 'connect' - it also works without issue.

Like IT Manager, I am also seeing no errors in the logs. We do not have the Web Control enabled in the Sophos Console - the default policy is present, but not enabled - so it looks like this is a bug - I say 'looks like' as I'm not certain I'm understanding what's happening here. I would expect to see a log entry for the failed attempt, but there is nothing. I have similarly been through section of the Windows Event viewer, and can see nothing relevant.

Do you know about this issue and have a fix/workaround? We can probably script something to prevent having to manually intervene, but it would be preferrable if there was a fix that you can provide?

Thank you in advance!

Rich

Hello Rich,

wondered why I got a notification regarding checkpoint SSL extender, couldn't remember I had answered on this thread :).

I'm afraid, I don't know more than what is in this thread - I'm neither Sophos nor using the extender.
Apart from the suggestion to give Process Monitor a try the only other ideas I have are:

1. enable tracing for the Windows Filtering Platform (WFP)
2. enable tracing for SWI/SWF

If there's no obvious anomaly you'd have to open a case with Support.

Christian

Hi Rich,

It's possible that the application is looping back web traffic to itself and doesn't expect a delay (which Sophos Web Protection introduces by scanning)  This would lead to no errors in Sophos logs if it is scanning and not blocking anything.

The suggestion to exclude localhost can be done in the Anti-Virus and HIPS policy under Authorization > Websites > Add > IP Address: 127.0.0.1.  Sophos cannot create exclusions via ports.

Hi MEric - thank you very kindly - that has done the trick!

There is a tiny concern in my tinier mind that by excluding local host in this way, we are introducing some risk.....can you comment on that? I hate to seem ungrateful (I am NOT!!) - just my limited understanding of what's happening inspires the question/uncertainty.....

Thanks again,

Rich

By creating this exclusion you are excluding all HTTP traffic originating from localhost from being scanned.  I do not see this as a risk as in order for HTTP traffic to be looped back to the local machine, a file/process must be running locally on the machine to create that traffic.  The file/processes are not covered by this loopback exclusion and will continue to be scanned/blocked if deemed malicious.

By creating this exclusion you are excluding all HTTP traffic originating from localhost from being scanned.  I do not see this as a risk as in order for HTTP traffic to be looped back to the local machine, a file/process must be running locally on the machine to create that traffic.  The file/processes are not covered by this loopback exclusion and will continue to be scanned/blocked if deemed malicious.