> Source: [sk110013](https://support.checkpoint.com/results/sk/sk110013)
# sk110013 - How to configure Check Point Security Gateway as HTTP/HTTPS Proxy
| Property | Value |
|----------|-------|
| Solution ID | sk110013 |
| Date Created | 2016-02-10 |
| Last Modified | 2025-09-23 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |
## Solution
**Table of Contents:**
1. Configuring a Security Gateway as an HTTP/HTTPS Proxy
2. Important Notes
3. Limitations
4. Proxy Errors
5. Proxy Chaining
6. Related Documentation
7. Related Solutions
### (1) Configuring a Security Gateway as an HTTP/HTTPS Proxy {#TOC01}
> **Part 1 of 2 - Configuring the Security Gateway object in SmartConsole**
> Show / Hide this section
> 1. From the left navigation panel, click **Gateways \& Servers**.
>
> 2. Double-click the Security Gateway / Cluster / VSX Virtual System object you would like to configure as an HTTP/HTTPS Proxy.
>
> 3. In the left panel, click the **HTTP/HTTPS Proxy** page.
>
> *Example:*
>
> 
> 4. Select "**Use this gateway as an HTTP/HTTPS Proxy**".
>
> 5. In the "**Proxy Mode**" section, select the applicable option:
>
> * **Transparent**
>
> All HTTP traffic on specified ports and interfaces is intercepted and processed by the Proxy code in the Security Gateway. No configuration is required on the clients.
> * **Non Transparent**
>
> All HTTP/HTTPS traffic on specified ports and interfaces is intercepted and processed by the Proxy code in the Security Gateway. Configuration of the proxy address and port is required on client machines.
> 6. In the "**Access Control**" section, select the applicable option for forwarding HTTP/HTTPS requests:
>
> * **All Internal Interfaces**
>
> HTTP/HTTPS traffic that arrives at interfaces with the Topology "Internal" is processed by the Proxy code in the Security Gateway.
> * **Specific Interfaces**
>
> HTTP/HTTPS traffic that arrives at the interfaces specified in the list is processed by the Proxy code in the Security Gateway.
>
> **Best Practice** - To maintain highest security, we recommend **not** to select external interfaces as proxy interfaces.
> 7. In the "**Ports**" section, add the applicable ports.
>
> By default, traffic is intercepted only on port 8080.
>
> You can add or edit ports as required.
>
> You can configure any port except ports 80 and 443 because the Multi-Portal feature uses them (web portals for various Software Blades).
> 8. In the "**Advanced** " section, click the "**Advanced**" button and enable the applicable proxy headers:
>
> * **X-Forward-For header (original client source IP address)**
>
> Select this option to include the actual source IP address in the HTTP.
>
> This header must be configured, if traffic will be forwarded to Identity Awareness Security Gateways that require this information for user identification.
> * **Proxy related headers**
>
> By default, the HTTP header contains the "`Via`" proxy related header.
>
> Clear this checkbox if you do not want to include it.
> 9. Configure the default next-proxy server:
>
> **Important Notes:**
> * The proxy server configuration in the object overrides the proxy server settings in **Global properties** \> **Proxy** (which apply to all Security Gateway / ClusterXL / Virtual System objects).
>
> * To configure specific next-proxy servers for specific URLs, refer to the section "Proxy Chaining".
>
> Steps:
> * To configure the default next-proxy server in a specific Security Gateway / ClusterXL object:
>
> 1. Expand **Network Management** \> click the **Proxy** page.
>
> 2. Select **Use custom proxy settings for this network object**.
>
> 3. Select **Use proxy server**.
>
> 4. Configure the applicable proxy server settings.
>
> * To configure the default next-proxy server in a specific Traditional VSX Cluster / Traditional VSX Virtual System object:
>
> **Note** - The proxy configuration in the Traditional VSX Cluster object applies to all Virtual Systems.
> 1. Expand **Topology** \> click the **Proxy** page.
>
> 2. Select **Use custom proxy settings for this network object**.
>
> 3. Select **Use proxy server**.
>
> 4. Configure the applicable proxy server settings.
>
> 10. Click **OK** to close the Security Gateway / Cluster / VSX Virtual System object.
>
>
>
>
>
> **Part 2 of 2 - Configuring the Access Control Policy in SmartConsole**
> Show / Hide this section
> 1. From the left navigation panel, click **Security Policies** \> **Access Control**.
>
> 2. Add an explicit rule that allows traffic to the Security Gateway / Cluster / VSX Virtual System to the configured proxy ports:
>
> |---------------------------------|-------------------------|---------------------------------------------------------------|--------|------------------------------------------|----------|-------|--------------------------------------------------------|
> | Name | Source | Destination | VPN | Services \& Applications | Action | Track | Install On |
> | Accept HTTP/HTTPS Proxy traffic | Relevant Source objects | Object of the Security Gateway / Cluster / VSX Virtual System | `*Any` | Relevant Service objects for proxy ports | `Accept` | `Log` | Security Gateway / Cluster object / VSX Virtual System |
>
> 3. Install the Access Control policy on the Security Gateway / Cluster / VSX Virtual System object.
### (2) Important Notes {#TOC02}
* To maintain highest security, we recommend not to select external interfaces as the relevant proxy interfaces.
* Check Point HTTP/HTTPS proxy is **not** a caching proxy (it does not cache commonly visited web pages to provide faster local access to hosts on the LAN).
* Logging:
The Security Gateway opens two connections (one connection with the client and one connection with the actual destination server), but only the Firewall blade can log both connections.
Other blades show only the connection between the client and the Security Gateway.
The "Destination" field of the log only shows the Security Gateway and not the actual destination server.
The "Resource" field shows the actual destination.
### (3) Limitations {#TOC03}
HTTP/HTTPS proxy support is **limited** for the following features/configurations:
>
> |----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> | Feature / Configuration | Comments |
> | IPv6 | Proxy can be used, but not for IPv6 connections. In dual IP stack, only IPv4 traffic is supported. Proxy Chaining does not support IPv6 HTTP/HTTPS traffic. In addition, refer to [sk112816 - Check Point support for IPv4 / IPv6 Proxy](https://support.checkpoint.com/results/sk/sk112816). |
> | Span Port / Mirror Port / Monitor Mode | Proxy is not supported when this feature is enabled. Refer to [sk98389](https://support.checkpoint.com/results/sk/sk98389). |
> | VPN Site-to-Site | Proxy can be used, but not over VPN connections. Refer to [sk93929](https://support.checkpoint.com/results/sk/sk93929). |
> | Mobile Access blade | Proxy can be used, but not over Mobile Access connections. |
> | Anti-Spam \& E-mail Security blade | Proxy is not supported when this feature is enabled. \*The Content-based Anti-Spam is not supported with proxy (only the IP Reputation is supported) |
> | Application Accounting | Not supported in Transparent Proxy configuration. |
> | HTTPS traffic | Not supported in Transparent Proxy configuration when the HTTPS traffic ports are configured in the 'ports' section of the proxy configuration. |
> | UserCheck | Users do not receive a UserCheck page for blocked HTTPS connections that pass through Proxy, but instead receive a message that the page could not be reached. Fixed in versions R80.10 and higher. Refer to [sk93184](https://support.checkpoint.com/results/sk/sk93184) and [sk85640](https://support.checkpoint.com/results/sk/sk85640). |
> | NTLM authentication | Not supported in Proxy configuration. Refer to [sk100214](https://support.checkpoint.com/results/sk/sk100214). |
> | Updatable Objects | Updatable Objects cannot be used in the Access Policy when the Security Gateway is configured as explicit proxy, as the connection's destination is the proxy itself and not the updatable object real destination IP address. |
The following features/configuration are **supported**, but might require some adjustments:
>
> |-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------|
> | Feature / Configuration | Comments | Integrated in |
> | VPN Remote Access with client E75.30 | The following configuration is required - add both internal and external interfaces to 'Specific Interfaces' setting in HTTP/HTTPS Proxy properties. | - |
> | UserCheck | UserCheck block page message is not shown when Security Gateway is configured as HTTP Proxy. To resolve the issue, add the portal IP address to the proxy exceptions list in your web browser, or use a proxy PAC file to exclude the portal from the connections that require a proxy. This allows the client to connect directly to the portal, without going through the proxy feature. Refer to [sk72100](https://support.checkpoint.com/results/sk/sk72100). | - |
> | Bridge mode | The following configuration is required - you must configure an IP address on the bridge interface. | - |
> | Cluster with Cluster Virtual IP address on a different subnet than the member's physical IP addresses | In case you encounter connectivity issues, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue (Issue ID 01223637). | R76 and higher |
> | Application \& URL Filtering with a single interface | When Security Gateway is configured as HTTP/HTTPS Proxy with a single interface, define the relevant rules in 'Application \& URL Filtering' policy as follows: Source - 'Any'; Destination - 'Any'. Refer to [sk80340](https://support.checkpoint.com/results/sk/sk80340). | - |
> | "`Page not found`" error | Error is shown when Security Gateway is configured as Non-transparent Proxy, if the same site is accessed on more than one destination port. [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue (Issue ID 01134342). | R75.47, R77 and higher |
> | Ports Leak in ClusterXL HA | If ClusterXL in High Availability mode is used as Proxy in Non Transparent mode, then NAT kernel table '`fwx_alloc`' on the Standby cluster member has significantly more entries than on the Active cluster member. "`NAT hide failure - no available port for hide NAT`" logs in SmartView Tracker will appear. Refer to [sk69480](https://support.checkpoint.com/results/sk/sk69480) and [sk93247](https://support.checkpoint.com/results/sk/sk93247). | R77 and higher |
> | HTTPS traffic | Supported in Non-Transparent Proxy configuration. | - |
> | Do not add timestamps according to RFC1323 for 'streamed' connections | Add the following kernel parameter to fwkern.conf file (For details refer to [sk26202 - Changing the kernel global parameters for Check Point Security Gateway](https://support.checkpoint.com/results/sk/sk26202)): **`cpas_tcp_do_rfc1323=0`** | - |
Additional notes:
* By default, Check Point Security Gateway does not support Reverse Proxy Functionality.
For Capsule Docs Reverse Proxy, refer to:
* [sk102973 - Check Point Capsule Docs - 3rd-party Reverse Proxy Server](https://support.checkpoint.com/results/sk/sk102973)
* [sk103706 - Capsule Docs On-Premises vs. Capsule Docs managed in the Cloud](https://support.checkpoint.com/results/sk/sk103706)
* [sk105123 - Check Point Capsule Docs, Endpoint Security and Remote Access VPN E80.61 / R77.20.01](https://support.checkpoint.com/results/sk/sk105123)
* [sk108375 - Check Point Capsule Docs, Endpoint Security and Remote Access VPN E80.62 / R77.30.01](https://support.checkpoint.com/results/sk/sk108375)
* On Scalable Chassis 40000 / 60000, Proxy connections will be dropped during failovers due to the fact that such connections are handled as a Local Connection, which has no backup (Issue 02331051).
### (4) Proxy Errors {#TOC04}
Below is a summary of proxy errors as it is seen in browser and in logs.
>
> |---------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------|
> | Error | Browser | Log |
> | DNS failure, no connectivity to DNS server | Gateway Timeout The requested URL couldn't be resolved | Reject Proxy: DNS timeout/error; Connection was rejected due to DNS timeout or error |
> | DNS server is available but no record for the URL request | Gateway Timeout The requested URL couldn't be resolved | Reject Proxy: Internal error; Connection was rejected due to internal error |
> | DNS server is available, record for URL also available but no Internet connection | This web page is not available ERR_TUNNEL_CONNECTION_FAILED | Reject Can't connect to server |
> | HTTP server failure, no connectivity to HTTP server | Gateway Timeout The requested URL couldn't be resolved | Reject Can't connect to server |
> | HTTPS server error "500/404" - usually it indicates on a problem with the HTML code or page not found | Server error 500 | Accept |
> | Server Reset: Server is up and running but not listens to HTTP/S ports. Can happen after reboot or internal server errors | Server error 502 | Accept |
> | Authentication failure: wrong credential in a password authentication | Unauthorized The server could not verify that you are authorized to access the document requested. | Accept |
### (5) Proxy Chaining {#TOC05}
Show / Hide this section
**Introduction to Proxy Chaining**
> Starting from the version R82, you can configure Proxy Chaining on Security Gateways to forward outbound IPv4 HTTP/HTTPS traffic to an upstream proxy server based on URL patterns.
>
> This enables a Security Gateway to support multi-layered proxy architectures for compliance, monitoring, or traffic routing purposes.
>
> You configure the applicable proxy settings and rules on the Security Gateway in the "`$FWDIR/conf/upstream_proxy_policy.txt`" file.
**Proxy Chaining Known Limitations**
* Proxy Chaining does not support IPv6 HTTP/HTTPS traffic.
**Configuring Proxy Chaining**
1. Prerequisite: Follow the steps in the section "Configuring a Security Gateway as an HTTP/HTTPS Proxy".
2. Connect to the command line on the Security Gateway / each Cluster Member / Scalable Platform Security Group.
3. Log in.
4. If the default shell is Gaia Clish / Gaia gClish, then go to the Expert mode:
`expert`
5. In the VSNext / Traditional VSX mode, go to the context of the applicable Virtual Gateway / Virtual System:
`vsenv `
6. Create the required configuration file:
* If the configuration file already exists:
`ls -l $FWDIR/conf/upstream_proxy_policy.txt`
then create a backup copy:
`cp -v $FWDIR/conf/upstream_proxy_policy.txt{,_BKP}`
* If the configuration file does not exist yet, then create it:
`touch $FWDIR/conf/upstream_proxy_policy.txt`
7. Edit the configuration file:
`vi $FWDIR/conf/upstream_proxy_policy.txt`
8. Configure the required proxy chaining settings and URL patterns.
**Important Notes about the `$FWDIR/conf/upstream_proxy_policy.txt` file:**
* You must install the Access Control policy after every change in this file.
*  If you edit this file on the Windows OS, you must save this file in the UNIX format.
*  In the file, you must only use **TAB** (not spaces) between the parameters and their values.
*  There is no new line at the end of this file.
* The policy installation fails if the content of this file is not in the correct format as described below.
Even if you disable the proxy chaining feature (set "`is_enabled`" to "`false`"), the syntax in this file must be valid.
* The file must contain three "sections":
1. Enable / Disable the Proxy Chaining feature:
|-----------------------------|
| `is_enabled {true | false}` |
* If set to "`true`", enables the Proxy Chaining feature.
* If set to "`false`", disables the Proxy Chaining feature.
2. Fallback to a Proxy Server behavior if there is no URL match:
|-------------------------------------|
| `is_direct_fallback {true | false}` |
* If "`is_direct_fallback`" is set to "`true`", the Security Gateway forwards the HTTP / HTTPS request based on the default next-proxy server configured in SmartConsole.
* If "`is_direct_fallback`" is set to "`false`", the Security Gateway ignores any proxy configuration in SmartConsole and forwards the HTTP / HTTPS request directly to the relevant host.
3. URL patterns:
|-----------------------------------------------------|
| ` :` |
* ``
This is a regular expression that defines one or more host domains.
* You must write this string in lower-case letters.
* You must configure at least one URL pattern.
* You can create up to 1024 URL patterns.
* The Security Gateway uses the configured upstream proxy servers in the order they are specified in this file.
 **Warning** - Do not use the RegEx open wildcard "`(.*)`" as the complete URL string. This will significantly increase CPU utilization on the Security Gateway.
* `:`
Configures the IP address and the listening port of the upstream proxy.
If you want a URL to bypass an upstream proxy (and forwards the HTTP / HTTPS request directly to the relevant host), then define the IP address and port with the null values: `0.0.0.0:0`
Example #1 for `$FWDIR/conf/upstream_proxy_policy.txt`:
>
> ```
> is_enabled true
> is_direct_fallback true
> .*mail.com 10.0.0.43:8080
> .*yahoo.com 0.0.0.0:0
> ```
>
> 1. The proxy chaining is enabled (*is_enabled = true*).
>
> 2. The fallback to the default next-proxy server is enabled (*is_direct_fallback = true*).
>
> 3. The HTTP / HTTPS connections to the domain `mail.com` will be directed to the upstream proxy server `10.0.0.43:8080`.
>
> 4. The HTTP / HTTPS connections to the domain `yahoo.com` will be directed to the relevant host (because the null values bypass any proxy).
>
> 5. The HTTP / HTTPS connections to any other domain (for example, `google.com`):
>
> * If the default next-proxy server **is** configured in the Management Server database, then the HTTP / HTTPS connections will be directed to the configured default next-proxy.
>
> * If the default next-proxy server is **not** configured in Management Server database, then the HTTP / HTTPS connections will be directed to the relevant host.
Example #2 for `$FWDIR/conf/upstream_proxy_policy.txt`:
>
> ```
> is_enabled true
> is_direct_fallback false
> .*mail.com 10.0.0.43:8080
> .*yahoo.com 10.0.0.44:8080
> ```
>
> 1. The proxy chaining is enabled (*is_enabled = true*).
>
> 2. The fallback to the default next-proxy server is disabled (*is_direct_fallback = false*).
>
> 3. The HTTP / HTTPS connections to the domain `mail.com` will be directed to the upstream proxy server `10.0.0.43:8080`.
>
> 4. The HTTP / HTTPS connections to the domain `yahoo.com` will be directed to the upstream proxy server `10.0.0.44:8080`.
>
> 5. The HTTP / HTTPS connections to any other domain (for example, `google.com`) will always be directed to the relevant host - regardless of whether the default next-proxy server is configured in Management Server database (because the fallback to the default next-proxy server is disabled explicitly).
9. Save the changes in the file and exit Vi editor.
10. On a Scalable Platform Security Group, copy the modified file to each Security Group Member:
`asg_cp2blades $FWDIR/conf/upstream_proxy_policy.txt`
11. Install the Access Control policy on the Security Gateway / Cluster / VSX Virtual System object.
### (6) Related Documentation {#TOC06}
* [R82 Security Gateway Administration Guide](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityGateway_Guide/Default.htm).
### (7) Related Solutions {#TOC07}
* [sk92482 - Performance impact from enabling HTTP/HTTPS Proxy functionality](https://support.checkpoint.com/results/sk/sk92482)
* [sk104639 - Mobile Access Reverse Proxy](https://support.checkpoint.com/results/sk/sk110348)
* [sk111171 - Security Gateway in HTTP/HTTPS Proxy mode sends TCP RST packet in response to TCP SYN packet](https://support.checkpoint.com/results/sk/sk111171)
* [sk112939 - Application Control and URL Filtering blades do not work when Security Gateway is configured as HTTP/HTTPS Proxy in Non Transparent mode](https://support.checkpoint.com/results/sk/sk112939)
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content