Check Point: AI assistant (LLM)

Paste this into your AI assistant to have it help configure Check Point (SmartConsole) to allow the RTA's outbound connection. It still pauses for your confirmation and for anything your R8x version does differently.

Configuration prompt

You are helping me configure my Check Point firewall (SmartConsole / Security
Management) so the Sophos Remote Testing Appliance (RTA) can reach its endpoint.
Work through the steps in order and show me the pending change before I install
policy.

CONTEXT:
- The RTA makes one outbound OpenVPN connection over TCP/443 to
  connect.remotetesting.secureworks.com, which resolves to the static IPs
  3.33.194.251 and 15.197.255.2.
- A plain "allow 443" is not enough on Check Point: the HTTPS Inspection blade
  re-signs the TLS session and resets the OpenVPN tunnel, and Application Control
  can classify the flow (OpenVPN / anonymizer / non-standard application on port
  443) and drop it.
- Some appliances also register over HTTPS to get.remotetesting.secureworks.com.
  Allow that destination by FQDN (its IPs are not static), and exempt it from
  HTTPS Inspection too.

STEPS:
1. Create the destination object. In SmartConsole, open
   Objects > New > Network Object > Domain (or use Updatable Objects if my
   gateway supports it, R81+). Name it rta-connect-endpoint and set the Domain
   name to connect.remotetesting.secureworks.com. The Domain object resolves at
   policy-installation time; the two static IPs 3.33.194.251 and 15.197.255.2 are
   an alternative if I prefer an IP-based rule.
2. Add an HTTPS Inspection bypass rule. Open
   Security Policies > HTTPS Inspection and add a Bypass rule above any catch-all
   inspect rule. Set Destination to the rta-connect-endpoint object, Service to
   HTTPS (443), and Action to Bypass. The bypass must sit above any rule that
   would inspect or drop TCP/443 to this destination, or it never matches.
3. Add an Access Control allow rule. Open
   Security Policies > Application Control & URL Filtering and add an Allow rule
   above any rule that blocks anonymizers or unrecognized applications. Set
   Destination to rta-connect-endpoint, add the OpenVPN application object in the
   Application/Site column (search "OpenVPN" in the application library), plus any
   categories my policy blocks (e.g. Anonymizers, Encrypted Tunnel), and set
   Action to Allow. If OpenVPN is not in my library, create a custom application
   under Objects > Application/Site > New matching TCP/443 to
   connect.remotetesting.secureworks.com and use that object in the rule.
4. If the IPS blade is active, add a protection exception under
   Security Policies > IPS > Exception scoped to Destination = rta-connect-endpoint
   and Protection = Tunneling Protocols (or the specific triggered protection shown
   in logs), and set it to Inactive for this traffic.
5. If my appliance is an activation-mode platform, also allow
   get.remotetesting.secureworks.com by FQDN (never by a hardcoded IP) and add it
   to the same HTTPS Inspection bypass.
6. When the pending configuration is ready, show it to me. After I confirm, tell me
   to click Install Policy, select the relevant policy package and target
   gateway(s), and confirm the installation completes without errors.

VERIFY:
- From a host on the RTA's network segment, run:
  nc -vz connect.remotetesting.secureworks.com 443
  A success looks like: Connection to connect.remotetesting.secureworks.com port
  443 [tcp/https] succeeded!
- In Logs & Monitor > Logs, filter by
  Destination = connect.remotetesting.secureworks.com and confirm traffic shows
  Action: Accept and HTTPS Inspection: Bypass.
- If I see Action: Drop with blade Application Control or HTTPS Inspection, the
  matching rule above is missing, sits below a blocking rule, or the policy has not
  been installed yet.

RULES YOU MUST FOLLOW:
- These steps are authoritative. If a menu, command, or option does not match what
  is written here (versions differ), STOP and show me what you actually see. Do not
  guess at equivalent settings or invent CLI syntax.
- Make the narrowest change that allows this one destination. Do not broaden an
  existing rule to "any", and do not disable, bypass, or pause the firewall, TLS/SSL
  decryption, or threat inspection globally to make it work.
- Allowlist connect.remotetesting.secureworks.com. Its two IPs (3.33.194.251 and
  15.197.255.2) are static, but get.remotetesting.secureworks.com (used on some
  platforms) is not, so allow that one BY FQDN, never by a hardcoded IP.
- Do not apply, commit, or deploy the change until I confirm. Show me the pending
  configuration first.
- Change only what these steps describe. Do not alter unrelated rules, objects, or
  policy, and do not touch anything outside allowing this destination.